jmespath

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

jmespath records in CISA KEV

No jmespath vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jmespath 2 records HIGH

Records

2 records

TI-2026-39057 CVE-2026-54133 · GHSA-pcw8-m77r-2528

jmespath.php has CompilerRuntime code injection via unescaped function names

HIGH 82

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00441 Published 2026-06-12 Fixed in 2.9.1 CWE-116

TI-2022-14146 CVE-2022-32511 · GHSA-5c5f-7vfq-3732

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

MEDIUM 53

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02425 Published 2022-06-06 Fixed in 1.6.1 CWE-502

Open these records in search →

Critical	2
High	0
Medium	0
Low	0
No CVSS	0