CVE-2026-1615 affects the jsonpath package prior to version 1.3.0, allowing arbitrary code injection via unsafe evaluation of user-supplied JSON Path expressions. The vulnerability stems from reliance on the static-eval module, which is not designed to safely process untrusted data. Attackers can exploit this by crafting malicious JSON Path expressions that execute arbitrary JavaScript code, resulting in remote code execution in Node.js environments or cross-site scripting in browser contexts. All evaluation methods of jsonpath are impacted. Red Hat has published multiple advisories addressing this issue, indicating vendor awareness and remediation efforts.

Successful exploitation can lead to remote code execution on Node.js platforms or cross-site scripting in browsers, allowing attackers to execute arbitrary JavaScript code. This poses a critical security risk, potentially compromising system integrity and confidentiality. The vulnerability affects all jsonpath methods that evaluate JSON Path expressions, increasing the attack surface.

Red Hat has published security advisories related to this vulnerability, indicating that fixes or updates are available through their errata channels. Users should consult the Red Hat advisories (https://access.redhat.com/security/cve/CVE-2026-1615 and related errata) for official patching instructions and apply updates accordingly. Since no explicit patch version is stated in the input, verify the vendor advisories for the exact fixed versions and apply them promptly. There is no indication that the vulnerability is already mitigated or requires no action.