Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-12 | 2 | Disclosure2 |
| 2026-06-13 | 1 | Patch1 |
| 2026-08-19 | 1 | Disclosure1 |
🔴 jmespathphp CompilerRuntime Code Injection, #CVE-2026-54133 (Critical) -DC-Aug2026-1644 https://dailycve.com/jmespathphp-compilerruntime-code-injection-cve-2026-54133-critical-dc-aug2026-1644/
Post summary
A new CVE for a code injection flaw in jmespathphp has been disclosed, but no PoC, exploit, patch, or active exploitation details are provided.
🚨 CRITICAL: CVE-2026-54133 (CVSS 9.8) jmespath[.]php <2.9.1 allows RCE via attacker-controlled expressions in CompilerRuntime. Patch to 2.9.1+ immediately or use AstRuntime for untrusted input. #CVE #Vulnerability #PatchNow https://t.co/rlw6DaX93V
Post summary
The tweet alerts on a critical RCE vulnerability in jmespath[.]php <2.9.1 and urges users to upgrade to 2.9.1+ or use AstRuntime to mitigate the issue.
CVE-2026-54133 Remote Code Execution in jmespath.php Before Version 2.9.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54133
Post summary
The text announces CVE-2026-54133, detailing a remote code execution vulnerability in jmespath.php versions earlier than 2.9.1, with no PoC, exploit code, active exploitation, or patch information provided.
CVE-2026-54133 jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data struc… https://www.cve.org/CVERecord?id=CVE-2026-54133
Post summary
The text provides a brief statement about CVE‑2026‑54133 and a link to its record, but offers no evidence of exploitation, patches, or technical details beyond the basic description.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jmespath | jmespath | - | php | - |