{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jmespath.php/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jmespath:jmespath:*:*:*:*:*:php:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-54133"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jmespath.php"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","php","code-injection"],"_cs_type":"advisory","_cs_vendors":["mtdowling"],"content_html":"\u003cp\u003eThe mtdowling/jmespath.php library is susceptible to a code injection vulnerability (CVE-2026-54133) affecting versions prior to 2.9.1. The vulnerability exists within the \u003ccode\u003eCompilerRuntime\u003c/code\u003e component, which is designed to optimize performance by compiling JMESPath expressions into PHP code before execution. An attacker who can provide input to an application that uses this library can craft a malicious JMESPath expression containing a non-identifier value in a function call position. Because the library fails to properly escape these function names before writing them into generated PHP cache files, the injected code is interpreted and executed by the PHP engine when the cache file is loaded. This vulnerability is triggered either through explicit use of \u003ccode\u003eJmesPath\\CompilerRuntime\u003c/code\u003e or by enabling the \u003ccode\u003eJP_PHP_COMPILE\u003c/code\u003e environment variable, which forces the usage of the compiler. Successful exploitation leads to remote code execution under the privileges of the web server process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an application endpoint that accepts user-supplied JMESPath expressions for data transformation or filtering.\u003c/li\u003e\n\u003cli\u003eThe application is confirmed to be using \u003ccode\u003emtdowling/jmespath.php\u003c/code\u003e versions \u0026lt; 2.9.1.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a crafted JMESPath expression string designed to exploit the missing escaping logic in the compiler.\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003eCompilerRuntime\u003c/code\u003e parses the expression and generates a temporary PHP cache file containing the attacker's injected payload.\u003c/li\u003e\n\u003cli\u003eThe application triggers the execution of the compiled expression, causing the PHP engine to include and evaluate the malicious cache file.\u003c/li\u003e\n\u003cli\u003eThe injected payload executes within the application process context.\u003c/li\u003e\n\u003cli\u003eThe attacker gains the ability to execute arbitrary PHP code, potentially leading to system compromise or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated or authenticated attackers (depending on the application's input exposure) to achieve remote code execution. Given that this library is a standard tool for handling JSON-like data in PHP applications, the potential scope includes any web application enabling \u003ccode\u003eJP_PHP_COMPILE\u003c/code\u003e or explicitly using the \u003ccode\u003eCompilerRuntime\u003c/code\u003e to process untrusted user input. Success results in full control over the application's PHP process, providing a path to access local files, modify application logic, or pivot deeper into the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003emtdowling/jmespath.php\u003c/code\u003e to version 2.9.1 or later to remediate CVE-2026-54133.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, disable the \u003ccode\u003eJP_PHP_COMPILE\u003c/code\u003e environment variable across all application environments to force the use of the safer \u003ccode\u003eAstRuntime\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit application code to identify usages of \u003ccode\u003eJmesPath\\CompilerRuntime\u003c/code\u003e and ensure that no user-controlled input is ever passed to these instances without rigorous validation.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or use allowlists for any JMESPath expressions accepted from external sources to prevent the injection of malicious characters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T20:56:10Z","date_published":"2026-08-18T20:56:10Z","id":"https://feed.craftedsignal.io/briefs/2026-08-jmespath-injection/","summary":"The mtdowling/jmespath.php library contains a critical code injection vulnerability, CVE-2026-54133, allowing attackers to execute arbitrary PHP code when untrusted JMESPath expressions are processed by the CompilerRuntime.","title":"Remote Code Execution in jmespath.php via CompilerRuntime","url":"https://feed.craftedsignal.io/briefs/2026-08-jmespath-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Jmespath.php","version":"https://jsonfeed.org/version/1.1"}