CVE-2026-54133
CompilerRuntime code injection via unescaped function names
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon GHSA.
Description
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| composer::GitHub Security Advisory Composer | mtdowling/jmespath.php | 2.9.1 |
| chainguard | nextcloud-server-33, nextcloud-server-34, py3-jmespath et 2 autres | 33.0.6-r9 et 2 autres |
| composer::PHP Security Advisories Database | mtdowling/jmespath.php | pas de correctif indiqué |
| minimos | nextcloud-server-32, nextcloud-server-33, nextcloud-server-34 | 32.0.13-r0 et 2 autres |
| rapidfort fedora 43 | nextcloud, nextcloud-httpd, nextcloud-mysql et 3 autres | 33.0.6-1.fc43 |
| rapidfort Oracle Linux 10 | nextcloud, nextcloud-httpd, nextcloud-mysql et 3 autres | 33.0.6-1.el10_2 |
| wolfi | nextcloud-server-33, py3-jmespath, ruby3.2-jmespath et 1 autres | 33.0.6-r9 et 1 autres |
Afficher les 26 entrées de 7 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| composer::GitHub Security Advisory Composer | mtdowling/jmespath.php | 2.9.1 |
| chainguard | nextcloud-server-33 | 33.0.6-r9 |
| chainguard | nextcloud-server-34 | 34.0.2-r0 |
| chainguard | py3-jmespath | 0 |
| chainguard | ruby3.2-jmespath | 0 |
| chainguard | ruby3.4-jmespath | 0 |
| composer::PHP Security Advisories Database | mtdowling/jmespath.php | pas de correctif indiqué |
| minimos | nextcloud-server-32 | 32.0.13-r0 |
| minimos | nextcloud-server-33 | 33.0.7-r0 |
| minimos | nextcloud-server-34 | 34.0.2-r0 |
| rapidfort fedora 43 | nextcloud | 33.0.6-1.fc43 |
| rapidfort fedora 43 | nextcloud-httpd | 33.0.6-1.fc43 |
| rapidfort fedora 43 | nextcloud-mysql | 33.0.6-1.fc43 |
| rapidfort fedora 43 | nextcloud-nginx | 33.0.6-1.fc43 |
| rapidfort fedora 43 | nextcloud-postgresql | 33.0.6-1.fc43 |
| rapidfort fedora 43 | nextcloud-sqlite | 33.0.6-1.fc43 |
| rapidfort Oracle Linux 10 | nextcloud | 33.0.6-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud-httpd | 33.0.6-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud-mysql | 33.0.6-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud-nginx | 33.0.6-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud-postgresql | 33.0.6-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud-sqlite | 33.0.6-1.el10_2 |
| wolfi | nextcloud-server-33 | 33.0.6-r9 |
| wolfi | py3-jmespath | 0 |
| wolfi | ruby3.2-jmespath | 0 |
| wolfi | ruby3.4-jmespath | 0 |