CVE-2026-1615 is a critical arbitrary code injection vulnerability in the jsonpath package prior to version 1.3.0. The vulnerability arises from unsafe evaluation of user-supplied JSON Path expressions using the static-eval module, which is not designed to safely handle untrusted data. Attackers can supply malicious JSON Path expressions that execute arbitrary JavaScript code, resulting in Remote Code Execution in Node.js or Cross-site Scripting in browsers. This affects all jsonpath methods that evaluate JSON Paths, including .query, .nodes, .paths, .value, .parent, and .apply. Red Hat's advisory highlights that while the vulnerability is serious, the risk in their products is mitigated by how jsonpath is used (often as a transitive dependency or not directly processing user input). Red Hat currently does not offer a mitigation that meets their standards for broad applicability and stability. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity.

Successful exploitation allows an attacker to execute arbitrary code remotely in Node.js environments or perform Cross-site Scripting attacks in browser contexts. This can lead to full compromise of the affected system or application, including unauthorized code execution, data integrity loss, and potential privilege escalation. The vulnerability requires no privileges or user interaction to exploit. Within Red Hat products, the exposure and criticality are reduced due to the usage context of the jsonpath component. No known exploits are reported in the wild at this time.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, or stability. Users should upgrade jsonpath to version 1.3.0 or later where the vulnerability is fixed. For Red Hat products, monitor vendor advisories for updates or patches. In environments where upgrading is not immediately possible, restrict or validate user input to jsonpath evaluation functions to prevent untrusted data processing. Customers using Red Hat Ansible Automation Platform 2.5 should apply the available update that includes a fix for this vulnerability.