Skip to content

2026-02-02 — jsonpath (NPM) prototype pollution (CVE-2025-61140 / GHSA-6c59-mwgh-r2x6)

Summary

GitHub reviewed an advisory for prototype pollution in the NPM package jsonpath.

  • Advisory: https://github.com/advisories/GHSA-6c59-mwgh-r2x6
  • CVE: CVE-2025-61140
  • Affected: jsonpath <= 1.1.1
  • Root cause (per advisory): insufficient input validation of object keys in lib/index.js (value function)

Why this matters

Prototype pollution is often “just” data integrity at first, but it can become a security boundary break when polluted properties influence:

  • authorization decisions (if (obj.admin) ...)
  • configuration objects (feature flags, template options, request options)
  • templating, deep-merge utilities, or code paths that assume trusted object shapes

If untrusted input can reach JSONPath expressions/operations in your app, treat this as potentially attacker-controlled object mutation.

What to do (durable guidance)

  1. Inventory exposure
  2. Search for jsonpath in package.json and lockfiles.

  3. Identify call sites where JSONPath queries are built from user input.

  4. Upgrade / replace

  5. The advisory lists no patched version at time of writing.

  6. Prefer replacing with a maintained JSONPath implementation, or constrain usage to trusted inputs only.

  7. Mitigate prototype pollution at boundaries

  8. Reject or sanitize keys like __proto__, prototype, constructor when mapping user-controlled data into objects.
  9. Consider using Object.create(null) for “map/dictionary” objects that ingest untrusted keys.

  10. Avoid unsafe deep-merge patterns with untrusted input.

  11. Add regression tests

  12. Add a test that attempts to pollute ({}).polluted (or similar) and asserts it remains undefined.