CVE-2026-54133
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the jmespath.php library allows an attacker to execute arbitrary PHP code when using the `JmesPath\CompilerRuntime` with an attacker-controlled JMESPath expression. The compiler fails to properly escape function names, enabling injection of malicious code into the generated cache file, which is then executed.
Risk Assessment
An attacker can remotely execute arbitrary PHP code on the server, leading to full application compromise, data theft, or system takeover.
Recommendation
Immediately update the jmespath.php library to version 2.9.1 or later. Until then, do not use `JmesPath\CompilerRuntime` with untrusted expressions; use `AstRuntime` instead.
Related vulnerabilities
- CVE-2026-106102Critical
Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.
- CVE-2026-105863Critical
Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- CVE-2026-105859Critical
Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105857Critical
The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105851Critical
Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-104070Critical
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.
- CVE-2026-67273Critical
Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-105845Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-105844Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-67269Critical
Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.
Original NVD description (English source)
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS