BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-06-30

Assigner: MITRE

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61140

Affected Vendors & Products

Vendor	Product	Version / Range
dchester	jsonpath	1.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

The vulnerability is a Prototype Pollution issue in the value function of jsonpath version 1.1.1, specifically in the lib/index.js file. Prototype Pollution allows an attacker to manipulate the prototype of base objects, potentially leading to unexpected behavior or security issues in applications using this library.

Impact Analysis

This vulnerability can allow attackers to modify the prototype of JavaScript objects, which may lead to application crashes, data corruption, or execution of arbitrary code depending on how the affected library is used within an application.

Hi! I’m here to help you understand CVE-2025-61140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70