Last active
January 28, 2026 04:16
-
-
Save Dremig/8105c189774217222a8ebea3ed4d341d to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [CVE ID] | |
| CVE-2025-61140 | |
| [PRODUCT] | |
| jsonpath 1.1.1 | |
| [VERSION] | |
| jsonpath 1.1.1 | |
| [PROBLEM TYPE] | |
| Prototype Pollution | |
| [DESCRIPTION] | |
| The Node.js package jsonpath 1.1.1 contains a Prototype Pollution vulnerability. This occurs because the library does not properly sanitize or validate special object keys (such as __proto__, constructor, or prototype) within path expressions in lib/index.js. An attacker can exploit this via methods like value() function to modify the global Object.prototype. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment