CVE-2026-1615

CVE-2026-1615 is a critical arbitrary code injection vulnerability affecting versions of the 'jsonpath' package prior to 1.2.0. It arises from the unsafe evaluation of user-supplied JSON Path expressions, which leverage the 'static-eval' module not designed for untrusted input. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript code, leading to Remote Code Execution in Node.js or Cross-site Scripting in browsers, impacting all methods that evaluate JSON Paths. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.