PT-2026-6378 · Npm · Jsonpath

Published 2026-01-28 · Updated 2026-01-28

OSV

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

GHSA-6C59-MWGH-R2X6

Affected Products

Jsonpath

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-61140 · Security Note
• https://osv.dev/vulnerability/GHSA-6c59-mwgh-r2x6 · Vendor Advisory
• https://github.com/dchester/jsonpath · Note
• https://github.com/dchester/jsonpath/commit/9631412641b7095f86840a7a45b5b3afc68b0fcb · Note
• https://github.com/dchester/jsonpath/issues/194 · Note
• https://github.com/dchester/jsonpath/pull/195 · Note
• https://github.com/dchester/jsonpath/issues/181 · Note
• https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d · Note