mtdowling/jmespath.php Code Injection Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- composer/mtdowling/jmespath.php (packagist)
- Patched version
- 2.9.1
An early warning has been issued for a critical code injection vulnerability in the mtdowling/jmespath.php package. This vulnerability, tracked as GHSA-PCW8-M77R-2528, affects versions prior to 2.9.1 and allows for the execution of arbitrary PHP code.
What happened
The mtdowling/jmespath.php package, a dependency available via Packagist, is reportedly vulnerable to code injection due to insufficient escaping of function names in generated PHP source. This vulnerability, identified as CVE-2026-54133, allows an attacker to execute arbitrary PHP code with the privileges of the PHP process. The vulnerability was first flagged on August 18, 2026, and is currently under investigation.
The affected component is composer/mtdowling/jmespath.php, with reported affected versions being those prior to 2.9.1. The patched version is 2.9.1. It is recommended to upgrade to this version or later to mitigate the risk. If an immediate upgrade is not feasible, it is advised to disable JP_PHP_COMPILE and avoid using JmesPath\CompilerRuntime with untrusted input.
What to do about it
- Upgrade to version 2.9.1 or later of mtdowling/jmespath.php to mitigate the vulnerability.
- If immediate upgrade is not possible, disable JP_PHP_COMPILE.
- Avoid using JmesPath\CompilerRuntime with untrusted input until the package is upgraded.
- Monitor the primary sources for updates on the vulnerability and any additional mitigations that may be recommended.
How 0Day would have caught this
composer/mtdowling/jmespath.php is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using composer/mtdowling/jmespath.php version prior to 2.9.1.
What should I do right now?
Upgrade to version 2.9.1 or later of mtdowling/jmespath.php. If immediate upgrade is not possible, disable JP_PHP_COMPILE and avoid using JmesPath\CompilerRuntime with untrusted input.
Is there an official fix available?
Yes, version 2.9.1 of mtdowling/jmespath.php is the patched version.
Where can I find more information about this vulnerability?
Consult the primary source at https://github.com/advisories/GHSA-pcw8-m77r-2528 for more details.