CVE-2025-61140: 
JavaScript vulnerability analysis and mitigation

CVE-2025-61140 is a Prototype Pollution vulnerability in the value function of the jsonpath npm package version 1.1.1, specifically in lib/index.js. The flaw allows network-accessible attackers to modify JavaScript object prototypes through maliciously crafted JSONPath expressions without requiring authentication or user interaction. It was disclosed on January 28, 2026, and affects jsonpath version 1.1.1 by dchester. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper handling of special object keys — such as __proto__, constructor, and prototype — within JSONPath path expressions processed by lib/index.js (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes). The library fails to sanitize or validate these reserved keys before traversing or assigning values, enabling an attacker to pollute Object.prototype via the jp.value() function when a user-controlled JSONPath expression is passed. This is also classified under CWE-502 (Deserialization of Untrusted Data). A public proof-of-concept disclosure exists as a GitHub Gist documenting the vulnerability mechanics (PoC Gist, jsonpath GitHub).

Successful exploitation allows an attacker to modify Object.prototype globally within the Node.js process, which can lead to unauthorized access to sensitive data (high confidentiality impact), manipulation of application logic and data (high integrity impact), and potential denial of service by corrupting shared object state (high availability impact). Because prototype pollution affects all objects inheriting from the polluted prototype, the blast radius can extend across the entire application, potentially enabling privilege escalation, authentication bypass, or remote code execution depending on how the application uses the affected objects (Red Hat Advisory, Red Hat Bugzilla).

No active in-the-wild exploitation has been observed, and no weaponized exploit kit usage has been reported as of the time of writing. A public proof-of-concept exists as a GitHub Gist published on January 28, 2026, documenting the attack vector via the value() function (PoC Gist). The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a Node.js application that uses jsonpath version 1.1.1 and passes user-controlled input to the jp.value() function (or similar methods that traverse object paths).
2. Craft malicious JSONPath expression: Construct a JSONPath expression that targets prototype-polluting keys, such as $.__proto__.polluted or $.constructor.prototype.polluted.
3. Inject payload: Submit the crafted expression as input to the application endpoint that invokes jp.value(obj, userControlledPath, maliciousValue), for example:

   jp.value({}, '__proto__.polluted', 'hacked');
   // Results in: ({}).polluted === 'hacked'

4. Achieve prototype pollution: The library traverses the path without sanitizing __proto__ or constructor, assigning the attacker-controlled value to Object.prototype.
5. Leverage polluted prototype: Exploit the polluted property to bypass security checks, manipulate application logic, or trigger downstream vulnerabilities (e.g., property existence checks that now return attacker-controlled values for all objects) (PoC Gist, jsonpath GitHub).

• Logs: Application logs showing JSONPath expressions containing __proto__, constructor, or prototype as path segments passed to jp.value() or related functions.
• Application Behavior: Unexpected properties appearing on plain JavaScript objects ({}) that were not explicitly set; authentication or authorization checks returning unexpected results due to prototype property injection.
• Process: Node.js process exhibiting anomalous behavior such as unexpected privilege escalation, data exfiltration, or crashes attributable to corrupted object prototype state.
• Network: Unusual or malformed JSON payloads in HTTP request bodies or query parameters containing __proto__, constructor.prototype, or similar prototype-targeting strings directed at API endpoints.

Organizations should immediately audit their Node.js applications for use of jsonpath version 1.1.1 and upgrade to a patched version once available. IBM has addressed this vulnerability in Cloud Pak for Business Automation (Cloud Pak Foundational Services 4.6.21, April 2026 iFixes), IBM Business Automation Insights (May 2026 iFixes), and IBM watsonx Orchestrate with watsonx Assistant Cartridge (IBM Cloud Pak Fix, IBM BAI Fix, IBM watsonx Fix). As a temporary workaround, implement strict input validation and sanitization of JSONPath expressions to reject any path segments containing __proto__, constructor, or prototype before passing them to the library. Red Hat has also tracked this issue and patch information is documented in their bug tracking system (Red Hat Bugzilla).

Red Hat tracked the vulnerability through their security response process and assigned it high severity in their Bugzilla system (Red Hat Bugzilla). IBM issued multiple security bulletins addressing the vulnerability across several enterprise products including Cloud Pak for Business Automation, Business Automation Insights, and watsonx Orchestrate (IBM Cloud Pak Fix). The vulnerability received coverage from security aggregators and Linux distribution security mailing lists, including openSUSE and Oracle Linux update notifications, reflecting broad ecosystem awareness of the issue.