The vulnerability exists in the value function of jsonpath 1.1.1, which is used in Red Hat Developer Hub. It is a Prototype Pollution vulnerability (CWE-502) that allows an attacker to manipulate the prototype of a base object, potentially leading to arbitrary code execution, privilege escalation, or denial of service. The vulnerability has a CVSS v3.1 base score of 9.8 with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Red Hat Developer Hub versions >=1.8 and <1.8.5, as well as >=1.9, are affected. Red Hat has released Developer Hub 1.8.5 but has not explicitly stated that this version fixes the vulnerability. The advisory notes that fixes for this vulnerability are not currently available and remediation status is under investigation or deferred. The vulnerability is tracked under Red Hat advisory RHSA-2026:6174 and is part of a larger set of CVEs addressed in Red Hat Developer Hub.

Successful exploitation of this Prototype Pollution vulnerability can lead to high impact on confidentiality, integrity, and availability. Attackers may execute arbitrary code, escalate privileges, or cause denial of service conditions. The vulnerability affects core functionality of Red Hat Developer Hub, potentially impacting enterprise-grade developer portals running on Kubernetes clusters. No known exploits in the wild have been reported yet.

As of the latest Red Hat advisory, no official fix has been released for this vulnerability. Red Hat Developer Hub 1.8.5 has been released, but it is not confirmed that this version addresses CVE-2025-61140. Users are advised to monitor Red Hat advisories for updates and apply patches once available. In the meantime, consider applying any available mitigations recommended by Red Hat or upgrading to fixed versions when they become available. Customers with Red Hat Technical Account Managers can seek direct guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.