Listen to this Post
mtdowling/jmespath.php is a PHP library that implements JMESPath, a query language for JSON documents. A critical vulnerability exists in versions prior to 2.9.1 where the `CompilerRuntime` can generate and execute attacker-controlled PHP code. The root cause is that the compiler emits parsed JMESPath function names into generated PHP source code without proper escaping. A maliciously crafted JMESPath expression can cause the generated cache file to contain executable PHP, which is then loaded by the compiler runtime.
The vulnerable flow is triggered when an application accepts or constructs a JMESPath expression from attacker-controlled input. The expression is evaluated using JmesPath\CompilerRuntime, or via `JmesPath\search()` with the `JP_PHP_COMPILE` environment flag enabled. The attacker crafts an expression that uses a non-identifier value where the parser expects a function callee. The compiler writes this unsanitized value directly into the generated PHP source file. This file is saved to the compiled-expression cache directory and then loaded by CompilerRuntime. At that point, the injected PHP code executes with the privileges of the PHP process.
The default runtime `AstRuntime` interprets the parsed expression tree and is not affected unless `JP_PHP_COMPILE` is enabled. Applications are most at risk when they explicitly instantiate CompilerRuntime, enable `JP_PHP_COMPILE` for performance, and accept user-provided JMESPath expressions. The vulnerability is patched in version 2.9.1 and later.
DailyCVE Form:
Platform: jmespath.php (PHP)
Version: < 2.9.1
Vulnerability: Code Injection
Severity: Critical (CVSS 9.8)
date: 2026-06-12
Prediction: 2026-06-15
What Undercode Say:
Check your `composer.lock` for the installed version:
composer show mtdowling/jmespath.php
Check if `JP_PHP_COMPILE` is enabled in your environment:
php -i | grep JP_PHP_COMPILE
Search for `CompilerRuntime` usage in your codebase:
grep -r "CompilerRuntime" /path/to/your/project grep -r "JmesPath\CompilerRuntime" /path/to/your/project
Search for `JP_PHP_COMPILE` references:
grep -r "JP_PHP_COMPILE" /path/to/your/project
Exploit: (Educational Purposes!)
A crafted JMESPath expression can exploit this vulnerability. The attacker supplies a non-identifier value as a function callee, for example:
'badfunc'('${@php_code_here}')
When `CompilerRuntime` processes this expression, it writes the unsanitized callee name directly into the generated PHP cache file without escaping. The resulting cache file contains executable PHP code. When `CompilerRuntime` loads this cache file, the injected code executes. The attacker does not need to control the data document being queried—only the JMESPath expression string. Proof-of-concept exploit code is publicly available.
Protection:
- Upgrade immediately to version 2.9.1 or later.
- If an immediate upgrade is not possible, disable `JP_PHP_COMPILE` in your environment.
- Do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions.
- Use the default `AstRuntime` for all untrusted expressions.
- Ensure applications accepting untrusted JMESPath expressions never evaluate them with the compiler runtime.
Impact:
Successful exploitation allows an attacker to execute arbitrary PHP code with the privileges of the PHP process. This can lead to complete compromise of the application and server, including data theft, system modification, and further lateral movement. The vulnerability is remotely exploitable and automatable with a CVSS score of 9.8 (Critical).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
