Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-1615
n/a jsonpath — Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path…
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N N H H H 8.2 .0109 64.2 —
AFFECTED
Product Versions Fixed
jsonpath unspecified —
org.webjars.npm:jsonpath unspecified —
TIMELINE
Jan 29 Reserved by snyk
Feb 9 Published (CNA: snyk)
Aug 25 RESCORED — CVE-2026-1615 (jsonpath). CVSS 9.2 → 8.2 (NVD).
Description
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| January 29, 2026 | Reserved | Reserved by snyk |
| February 9, 2026 | Published | Published (CNA: snyk) |
| August 25, 2026 | RESCORED | RESCORED — CVE-2026-1615 (jsonpath). CVSS 9.2 → 8.2 (NVD). |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| n/a | jsonpath | — | — | — |
| n/a | org.webjars.npm:jsonpath | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-1615 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
