CVE-2026-54133

Name of the Vulnerable Software and Affected Versions jmespath.php versions prior to 2.9.1

Description Insufficient escaping of parsed JMESPath function names into generated PHP source allows for the generation and execution of attacker-controlled PHP code. This occurs when JmesPathCompilerRuntime is used with a crafted JMESPath expression, causing the generated cache file to contain executable code that is subsequently loaded by the compiler runtime.

Recommendations Update to version 2.9.1 or later. Disable JP PHP COMPILE as a temporary workaround. Avoid using JmesPathCompilerRuntime with attacker-controlled expressions and use the default AstRuntime for untrusted expressions instead.