CVE-2025-61140
EUVD-2025-20648628.01.2026, 16:16
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| dchester | jsonpath | 1.1.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.1 | 1770282458 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | 1772214630 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1772552788 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1774545605 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1775140647 ≤ 𝑥 < * | ADP |
| Red Hat | Self-service automation portal 2.0 | 1770281704 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- CWE-502 - Deserialization of Untrusted DataThe application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
References