EUVD-2026-36431Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable RCE with no auth or UI, but exploitation depends on the app using CompilerRuntime with untrusted expressions, so AC:H rather than AC:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in 2.9.1 and later. As a workaround, disable JP_PHP_COMPILE and do not use JmesPath\CompilerRuntime with attacker-controlled expressions. Use the default AstRuntime for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
Articles & Coverage 2
AnalysisAI
Remote code execution in jmespath.php versions prior to 2.9.1 allows attackers controlling JMESPath expressions to inject arbitrary PHP into compiler-generated cache files, which are then loaded and executed by JmesPath\CompilerRuntime. The flaw stems from insufficient escaping of parsed function names when the compiler emits PHP source, enabling code execution whenever an application evaluates untrusted expressions through the compiler runtime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target PHP application to (1) instantiate JmesPath\CompilerRuntime - or have JP_PHP_COMPILE enabled so the facade selects the compiler - rather than the default AstRuntime, (2) pass an attacker-controlled JMESPath expression string into that runtime's compile/search call, and (3) run jmespath/jmespath.php at a version below 2.9.1 with a writable compiler cache directory the PHP process can later include. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 and is technically defensible for any web application that forwards user-supplied expressions to CompilerRuntime, since exploitation then becomes a single crafted HTTP parameter. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A web application exposes a search or reporting endpoint that accepts a JMESPath expression from the client and evaluates it server-side through JmesPath\CompilerRuntime for performance. An unauthenticated attacker submits an expression whose function-name token is crafted to break out of the generated PHP literal and append arbitrary statements (for example, a system() call), the compiler writes the malicious file to the cache directory and immediately includes it, and the attacker's payload runs under the PHP-FPM/web-server user, yielding full RCE. |
| Remediation | Vendor-released patch: upgrade jmespath/jmespath.php to 2.9.1 or later via Composer (composer require jmespath/jmespath.php:^2.9.1) and clear any previously generated compiler cache files on disk, since poisoned cache entries written before the upgrade would still execute on include. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Conduct inventory of all systems running jmespath.php <2.9.1; take affected applications offline or network-isolate them from production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authenticated remote code execution in Pheditor 2.0.1-2.0.3 lets any logged-in user with the default terminal permission
Remote code execution in YesWiki prior to 4.6.6 allows unauthenticated attackers to inject arbitrary PHP via the Bazar C
Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate
DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitra
Share
External POC / Exploit Code
Leaving vuln.today