CVE-2026-54133: jmespath.php has CompilerRuntime code injection via unescaped function names

Synopsis

This is a code injection vulnerability in jmespath.php, a PHP library for extracting data from JSON documents using JMESPath expressions. The flaw is reachable over the network with no authentication required, and affects applications that pass attacker-controlled JMESPath expressions to the CompilerRuntime class, which emits unescaped function names directly into generated PHP cache files. Successful exploitation gives an attacker arbitrary remote code execution on the host running the PHP application. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network; an attacker must be able to send a crafted JMESPath expression to any application endpoint that passes user input to CompilerRuntime.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated request carrying a malicious JMESPath expression is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No user action or social engineering is required; the attacker drives exploitation entirely through their own network request.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required to achieve code injection.

Blast Radius

• Attacker executes arbitrary PHP code in the context of the web server process, gaining full control over application logic and runtime state.
• Attacker reads any file or secret accessible to the PHP process, including database credentials, API keys, and session tokens stored on disk or in environment variables.
• Attacker writes or modifies files on the host filesystem reachable by the PHP process, including the application source, configuration files, and generated cache files.
• Attacker can crash or destabilize the application process, causing a denial of service for all users of the affected service.