{"id":"CVE-2026-54133","title":"jmespath.php: jmespath.php has CompilerRuntime code injection via unescaped function names (CVE-2026-54133)","summary":"A flaw was found in jmespath.php, a library for processing JSON documents in PHP applications. This vulnerability allows a remote attacker to execute arbitrary code by crafting a malicious JMESPath expression. The `JmesPath\\CompilerRuntime…","severity":"critical","cvss":9.8,"cvssSource":"ghsa","cwe":["CWE-20","CWE-94","CWE-116"],"vendor":"Red Hat","product":"mtdowling/jmespath.php","affected":["mtdowling/jmespath.php < 2.9.1"],"patched":["mtdowling/jmespath.php 2.9.1"],"published":"2026-06-12","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:20:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54133.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54133.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-54133"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54133"},{"url":"https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54133"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/mtdowling/jmespath.php/CVE-2026-54133.yaml"},{"url":"https://github.com/advisories/GHSA-pcw8-m77r-2528"}],"tags":["csaf","vex","red-hat","ghsa","composer"],"epss":0.00417,"epssPercentile":0.35707,"aliases":["GHSA-pcw8-m77r-2528"],"ecosystem":"composer","ingestedAt":"2026-08-18T20:22:15.558Z","slug":"CVE-2026-54133","body":"## Overview\n\nA flaw was found in jmespath.php, a library for processing JSON documents in PHP applications. This vulnerability allows a remote attacker to execute arbitrary code by crafting a malicious JMESPath expression. The `JmesPath\\CompilerRuntime` component fails to properly escape function names, leading to the generation and execution of attacker-controlled PHP code within the application's cache file. This could result in a complete compromise of the affected system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54133.json)\n\n**jmespath.php: jmespath.php has CompilerRuntime code injection via unescaped function names**. Released 2026-06-12, updated 2026-09-23.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.\n\n## Package advisory (CVE-2026-54133)\n\nAffected packages:\n\n- `mtdowling/jmespath.php < 2.9.1`\n\nPatched in:\n\n- `mtdowling/jmespath.php 2.9.1`\n\nSource: https://github.com/advisories/GHSA-pcw8-m77r-2528","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}