CVE-2026-54133

Vulnerability

The JMESPath PHP library (jmespath.php) prior to version 2.9.1 contains a code injection vulnerability in the JmesPath\CompilerRuntime component. When an application uses CompilerRuntime (or enables JP_PHP_COMPILE) to evaluate a JMESPath expression provided by an attacker, the compiler inserts parsed function names into generated PHP source code without proper escaping. A carefully crafted expression can cause the generated cache file to contain attacker-controlled PHP code, which is then loaded and executed by CompilerRuntime. The issue affects all versions before 2.9.1 [1].

Exploitation

An attacker must be able to supply a JMESPath expression to an application that uses JmesPath\CompilerRuntime or has JP_PHP_COMPILE enabled. The attacker crafts the expression to include a non-identifier value (e.g., a string containing PHP code) where the parser expects a function callee. The compiler writes this value into the generated PHP source without safely escaping it as a string literal. The generated source is written to the compiled-expression cache directory and then loaded by CompilerRuntime, which triggers execution of the injected PHP code. No authentication or user interaction beyond providing the expression is required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary PHP code with the privileges of the PHP process. This can lead to full compromise of the application, including data theft, modification, or further server-side attacks. The impact is Remote Code Execution (RCE), affecting confidentiality, integrity, and availability [1].

Mitigation

The vulnerability is patched in version 2.9.1 and later [1]. As a workaround, disable JP_PHP_COMPILE and avoid using JmesPath\CompilerRuntime with attacker-controlled expressions; use the default AstRuntime for untrusted expressions. Applications that cannot upgrade immediately should ensure that untrusted JMESPath expressions are never evaluated by the compiler runtime. No EOL or KEV listing is noted [1].