CVE-2026-1615: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1615 is an Arbitrary Code Injection vulnerability in the jsonpath npm package (maintained by dchester) affecting all versions before 1.3.0. The flaw allows unauthenticated remote attackers to execute arbitrary JavaScript code by supplying malicious JSON Path expressions, leading to Remote Code Execution (RCE) in Node.js environments or Cross-Site Scripting (XSS) in browser contexts. It was disclosed on June 20, 2025, and published to CVE databases on February 9, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Bugzilla, Snyk JS Advisory).

The root cause is improper control of code generation (CWE-94), compounded by prototype pollution issues (CWE-1321). The jsonpath library passes user-supplied JSON Path filter and script expressions directly to the static-eval module for evaluation; static-eval is not designed to safely handle untrusted input and can be bypassed to execute arbitrary JavaScript. Attackers can craft expressions using techniques such as @.constructor.constructor("return process")(), new Function(...), require("fs"), or IIFE patterns within filter expressions (e.g., $[?((function(){...})())]) to escape the intended sandbox. All public-facing API methods that evaluate expressions — .query, .nodes, .paths, .value, .parent, and .apply — are affected. The fix (commit b61111f) introduces an AST allowlist (isSafeAst) that blocks dangerous node types including CallExpression, NewExpression, FunctionExpression, and access to unsafe property names like constructor, __proto__, and prototype (GitHub Commit, Snyk JS Advisory).

Successful exploitation in Node.js server-side environments results in full Remote Code Execution under the process's privileges, enabling an attacker to read or exfiltrate sensitive data, modify application state, install backdoors, or pivot laterally within the infrastructure. In browser contexts, exploitation leads to Cross-Site Scripting, allowing session hijacking, credential theft, or malicious script injection against end users. Downstream IBM products — including App Connect Enterprise, Cloud Pak for AIOps, Business Automation Insights, and watsonx Orchestrate — are confirmed affected, broadening the enterprise impact surface (IBM ACE Advisory, IBM CloudPak Advisory, Red Hat Bugzilla).

Snyk's threat intelligence confirms a proof-of-concept (PoC) exists for this vulnerability, and the CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT (Snyk JS Advisory). No confirmed in-the-wild exploitation or threat actor attribution has been reported as of the latest data. The EPSS score is approximately 0.29% (29th percentile), indicating a currently low but non-negligible probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication and no user interaction, making it trivially weaponizable in any application that passes untrusted input to jsonpath API methods (Feedly).

1. Reconnaissance: Identify Node.js applications or APIs that accept user-controlled input and pass it to the jsonpath package (versions < 1.3.0) for evaluation — e.g., search endpoints, data query APIs, or JSON filtering services.
2. Craft malicious JSON Path expression: Construct a payload that abuses static-eval's unsafe evaluation. A classic RCE payload uses the constructor chain: $[?(@.foo["constructor"]["constructor"]("return process")().exit(1))] or an IIFE: $[?((function(){return require('child_process').execSync('id').toString()})())].
3. Submit payload: Send the crafted JSON Path expression as input to any vulnerable API method (.query, .nodes, .paths, .value, .parent, or .apply) via the application's interface (HTTP request body, query parameter, WebSocket message, etc.).
4. Achieve code execution: The static-eval module evaluates the expression without sandboxing, executing the embedded JavaScript in the Node.js process context. This can be used to spawn a reverse shell, exfiltrate environment variables/secrets, or read the filesystem.
5. XSS variant (browser): In browser contexts, inject a payload that calls alert(document.cookie) or exfiltrates data via fetch() to an attacker-controlled server, exploiting the same unsafe evaluation path (GitHub Commit, Snyk JS Advisory).

• Network: Unexpected outbound connections from Node.js application servers to unknown external IPs or domains (potential reverse shell or data exfiltration); HTTP requests containing JSON Path expressions with keywords such as constructor, __proto__, prototype, require, eval, process, Function, or IIFE patterns ((function(){).
• Logs: Application logs showing errors or stack traces from static-eval or jsonpath during expression evaluation; access logs with encoded or obfuscated JSON Path strings in query parameters or request bodies.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python); unexpected calls to child_process.exec or child_process.execSync originating from the application.
• File System: New or modified files in the application directory created by the Node.js process (e.g., web shells, cron jobs, SSH authorized_keys modifications); unexpected script files written to /tmp or world-writable directories.

The primary remediation is to upgrade the jsonpath npm package to version 1.3.0 or higher, which introduces an AST-level allowlist that blocks all dangerous expression types before evaluation (GitHub Commit, Snyk JS Advisory). As an interim workaround, strictly validate and sanitize all user-supplied JSON Path expressions before passing them to any jsonpath API method, rejecting inputs containing constructor, __proto__, prototype, function calls, or other code-execution patterns. IBM has released patches for affected products: App Connect Enterprise, Cloud Pak for AIOps, Business Automation Insights (May 2026 iFixes), and watsonx Orchestrate — customers should apply the relevant IBM security bulletins (IBM ACE Advisory, IBM BAI Advisory, IBM watsonx Advisory). Red Hat has also issued errata (RHSA-2026:6174, RHSA-2026:6802) for affected Red Hat products (Red Hat Errata).

IBM issued multiple security bulletins acknowledging the impact on its enterprise products and providing patched versions (IBM ACE Advisory, IBM CloudPak Advisory). Red Hat tracked the issue via Bugzilla and released errata updates. The vulnerability was noted in security community feeds including The Hacker Wire and Infosec Exchange, with general commentary highlighting the risk of using static-eval for untrusted input processing. Snyk credited researcher Nick Copi with discovery and published detailed advisories for both the npm and Maven (WebJars) packaging of the library (Snyk JS Advisory).