CVE-2025-61140: Dchester jsonpath prototype pollution vulnerability

DDchester · Jsonpath

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

9.8 CVSS 3.1 Critical EPSS 0.51% · top 58.5% CWE-1321 · Prototype pollutionCWE-502 · Deserialization of untrusted data

9.8CVSS 3.1 base score

0.51%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

11References

7 Sep 2026Last modified by NVD

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

DJsonpath Dchester

References

Link	Tags
https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d	Third Party Advisory
https://github.com/dchester/jsonpath	Product
https://access.redhat.com/errata/RHSA-2026:2180	Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:2181	Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:3960	Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:3962	Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:6174	Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:6802	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-61140	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2433946	Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61140.json	Third Party Advisory

Track CVE-2025-61140 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-34621Adobe Acrobat Reader prototype pollution leads to code executionAdobe Acrobat and Reader (versions 24.001.30356, 26.001.21367 and earlier) are affected by prototype pollution (CWE-1321) that can result in arbitrar…KEVEPSS 2.2%analysed11 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2025-61140), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.