What is the CVSS score of CVE-2026-54133?

CVE-2026-54133 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of jmespath.php are affected by CVE-2026-54133?

jmespath.php versions prior to 2.9.1 contain a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary PHP code through malicious JMESPath expressions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-54133?

Yes, a public proof-of-concept exploit is available for CVE-2026-54133. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-54133?

24 hours: Conduct inventory of all systems running jmespath.php <2.9.1; take affected applications offline or network-isolate them from production. 7 days: Implement compensating controls-strict input validation (allowlist-only JMESPath syntax), disable dynamic compilation where feasible, and deploy WAF rules blocking injection patterns. 30 days: Establish automated scanning and patch management process; upgrade to jmespath.php 2.9.1 when released and verified.

jmespath.php CVE-2026-54133

EUVD-2026-36431 CRITICAL

Improper Input Validation (CWE-20)

2026-06-12 GitHub_M

PHP Information Disclosure Jmespath Php

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable RCE with no auth or UI, but exploitation depends on the app using CompilerRuntime with untrusted expressions, so AC:H rather than AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 12, 2026 - 16:01 EUVD

Analysis Generated

Jun 12, 2026 - 14:51 vuln.today

DescriptionCVE.org

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in 2.9.1 and later. As a workaround, disable JP_PHP_COMPILE and do not use JmesPath\CompilerRuntime with attacker-controlled expressions. Use the default AstRuntime for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.

Articles & Coverage 2

News 3 New PHP Vulnerabilities - 2 Critical, 1 High Severity Jun 13, 2026 News Critical RCE in PHP jmespath.php before 2.9.1 - CVE-2026-54133 Jun 12, 2026

AnalysisAI

Remote code execution in jmespath.php versions prior to 2.9.1 allows attackers controlling JMESPath expressions to inject arbitrary PHP into compiler-generated cache files, which are then loaded and executed by JmesPath\CompilerRuntime. The flaw stems from insufficient escaping of parsed function names when the compiler emits PHP source, enabling code execution whenever an application evaluates untrusted expressions through the compiler runtime. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects unauthenticated network-reachable RCE in any web app that pipes user input into the compiler.

Technical ContextAI

JMESPath is a declarative query language for JSON, and jmespath.php is the official PHP implementation maintained at github.com/jmespath/jmespath.php. The library offers two evaluation backends: AstRuntime (interprets the parsed expression tree at runtime) and CompilerRuntime (transpiles the expression into a PHP file written under a cache directory and includes it for performance). The vulnerability is a CWE-20 Improper Input Validation realized as a code-generation injection: parsed JMESPath function-name tokens are concatenated into emitted PHP source without escaping, so a crafted expression breaks out of the intended string/identifier context and embeds arbitrary PHP statements that execute on the next include. The affected CPE is cpe:2.3:a:jmespath:jmespath.php:*:*:*:*:*:*:*:* covering all versions below 2.9.1.

RemediationAI

Vendor-released patch: upgrade jmespath/jmespath.php to 2.9.1 or later via Composer (composer require jmespath/jmespath.php:^2.9.1) and clear any previously generated compiler cache files on disk, since poisoned cache entries written before the upgrade would still execute on include. If immediate upgrade is impossible, apply the vendor-documented workarounds: unset or set the JP_PHP_COMPILE environment variable to disabled, switch all evaluation sites to the default AstRuntime instead of JmesPath\CompilerRuntime, and ensure any code path that accepts untrusted expressions never reaches the compiler runtime - the trade-off is the loss of the compiled-evaluation performance benefit, which is typically minor for non-hot paths. Full advisory and patch details: https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528.