CVE-2026-54133

{
  "id": "CVE-2026-54133",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T15:16:31.890",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime."
    },
    {
      "lang": "es",
      "value": "jmespath.php permite a los usuarios usar JMESPath, software para especificar declarativamente cómo extraer elementos de un documento JSON, en aplicaciones PHP con estructuras de datos PHP. Las versiones anteriores a la 2.9.1 pueden generar y ejecutar código PHP controlado por el atacante cuando se usa “JmesPath\\CompilerRuntime” con una expresión JMESPath controlada por el atacante. El compilador emite nombres de funciones JMESPath analizados en el código fuente PHP generado sin suficiente escape. Una expresión manipulada puede hacer que el archivo de caché generado contenga PHP ejecutable controlado por el atacante, que luego es cargado por el tiempo de ejecución del compilador. El problema está parcheado en “2.9.1” y versiones posteriores. Como solución alternativa, deshabilite “JP_PHP_COMPILE” y no use “JmesPath\\CompilerRuntime” con expresiones controladas por el atacante. Use el “AstRuntime” predeterminado para expresiones no confiables. Las aplicaciones que deben seguir aceptando expresiones JMESPath no confiables antes de la actualización deben asegurarse de que esas expresiones nunca sean evaluadas por el tiempo de ejecución del compilador."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jmespath",
          "product": "jmespath.php",
          "versions": [
            {
              "version": "< 2.9.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T15:07:03.703942Z",
          "id": "CVE-2026-54133",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jmespath:jmespath:*:*:*:*:*:php:*:*",
              "versionEndExcluding": "2.9.1",
              "matchCriteriaId": "2F2D7DD9-AC56-45ED-AD62-DC5023908049"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}