Skip to content
Threat Feed
Subscribe

Product

Jmespath.php

1 brief RSS
critical advisory

Remote Code Execution in jmespath.php via CompilerRuntime

The mtdowling/jmespath.php library contains a critical code injection vulnerability, CVE-2026-54133, allowing attackers to execute arbitrary PHP code when untrusted JMESPath expressions are processed by the CompilerRuntime.

jmespath.php remote-code-execution php code-injection
1t 1c