JMESPath PHP Code Injection via Unsafe Compiler Output

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

jmespath.php is a popular library that enables PHP developers to use JMESPath expressions for querying JSON data structures. Versions before 2.9.1 contain a critical code injection vulnerability where the JmesPath\CompilerRuntime fails to properly escape function names when generating cached PHP source files. An attacker can craft a malicious JMESPath expression that, when processed by the vulnerable compiler, injects arbitrary PHP code into the generated cache file. This code then executes with the privileges of the PHP application, affecting any web application or service that processes untrusted JMESPath expressions through this library—making this a high-impact vulnerability for API backends, data transformation pipelines, and any system accepting user-supplied query logic.

Casky's 301 matching skills leverage Claude's extended reasoning to identify the attack patterns behind this vulnerability by analyzing code generation and injection techniques across MITRE ATT&CK's Resource Development (TA0001) and Execution (TA0043) phases. Practitioners using Casky would observe detection of unsafe input handling patterns (CWE-20), code generation flaws (CWE-94), and insufficient encoding validation (CWE-116) within JMESPath expression parsing flows. The platform's skills would flag suspicious compiler output where function names lack proper escaping, trace how attacker-controlled expressions propagate into generated PHP code, and identify execution of dynamically generated code from untrusted sources—helping teams pinpoint vulnerable code patterns before exploitation and validate secure versions of the library.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-54133.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-54133

Casky has 301 skills that investigate the attack patterns behind CVE-2026-54133. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn