CVE-2025-61140

Опубликовано: 28 янв. 2026

Источник: nvd

CVSS3: 9.8

CVSS3: 8.8

EPSS Низкий

Описание

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Ссылки

https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d
Third Party Advisory
https://github.com/dchester/jsonpath
Product
https://access.redhat.com/errata/RHSA-2026:2180
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:2181
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:3960
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:3962
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:6174
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:6802
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-61140
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2433946
Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61140.json
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dchester:jsonpath:1.1.1:*:*:*:*:node.js:*:*

EPSS

Процентиль: 35%

0.00419

Низкий

9.8 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-1321

CWE-502

Связанные уязвимости

CVE-2025-61140

CVSS3: 8.8

redhat

7 месяцев назад

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

GHSA-6c59-mwgh-r2x6

github

7 месяцев назад

JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

openSUSE-SU-2026:20239-1

suse-cvrf

6 месяцев назад

Security update for golang-github-prometheus-prometheus

SUSE-SU-2026:1008-1

suse-cvrf

5 месяцев назад

Security update for Prometheus

SUSE-SU-2026:1013-1

suse-cvrf

5 месяцев назад

Security update 5.0.7 for Multi-Linux Manager Client Tools

EPSS

Процентиль: 35%

0.00419

Низкий

9.8 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-1321

CWE-502