Prototype pollution in jsonpath - CVE-2025-61140

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123310

Prototype pollution in jsonpath - CVE-2025-61140

Published: February 27, 2026


Vulnerability identifier: #VU123310
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-61140
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


Affected software

jsonpath
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Multi-Linux Manager Beta Client Tools for SLE Micro
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools for SLE
SUSE Multi-Linux Manager Beta Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
IBM Sterling Secure Proxy
App Connect Enterprise Certified Container
mgrctl-lang
mgrctl-zsh-completion
mgrctl-bash-completion
mgrctl
mgrctl-debuginfo
firewalld-prometheus-config
dracut-wireless
golang-github-QubitProducts-exporter_exporter
python3-defusedxml
prometheus-postgres_exporter
prometheus-postgres_exporter-debuginfo
golang-github-prometheus-promu-debuginfo
golang-github-prometheus-promu
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager
golang-github-prometheus-alertmanager-debuginfo
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
supportutils-plugin-salt
golang-github-prometheus-node_exporter-debuginfo
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
golang-github-prometheus-prometheus
golang-github-prometheus-prometheus-debuginfo
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
supportutils-plugin-susemanager-client
python3-mgr-push
mgr-push
python3-uyuni-common-libs
python3-spacewalk-client-tools
spacewalk-client-tools
python3-rhnlib
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
grafana-debuginfo
grafana
venv-salt-minion

How to mitigate CVE-2025-61140

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

jsonpath - update to 1.1.2
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
mgrctl-lang - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-zsh-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-bash-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-debuginfo - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
firewalld-prometheus-config - addressed in versions 0.1-150000.3.67.1, 0.1-159000.4.3.2
dracut-wireless - update to 0.1.1595937550.0285244-159000.2.2.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.21.1, 0.4.0-159000.2.2.1
python3-defusedxml - update to 0.7.1-159000.4.2.1
prometheus-postgres_exporter - update to 0.10.1-159000.2.2.1
prometheus-postgres_exporter-debuginfo - update to 0.10.1-159000.2.2.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - addressed in versions 0.26.0-150000.1.30.2, 0.26.0-159000.2.2.1
golang-github-prometheus-alertmanager - update to 0.28.1-159000.12.2.1
golang-github-prometheus-alertmanager-debuginfo - update to 0.28.1-159000.12.2.1
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
golang-github-lusitaniae-apache_exporter-debuginfo - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
dracut-saltboot - addressed in versions 1.1.0-150000.1.65.1, 1.1.0-159000.2.2.1
supportutils-plugin-salt - update to 1.2.3-159000.4.2.1
golang-github-prometheus-node_exporter-debuginfo - update to 1.9.1-159000.4.2.1
golang-github-prometheus-node_exporter - update to 1.9.1-159000.4.2.1
golang-github-boynux-squid_exporter - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-boynux-squid_exporter-debuginfo - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-prometheus-prometheus - addressed in versions 3.5.0-150000.3.67.1, 3.5.0-159000.4.3.2
golang-github-prometheus-prometheus-debuginfo - update to 3.5.0-159000.4.3.2
release-notes-susemanager-proxy - update to 4.3.17-150400.3.107.1
release-notes-susemanager - update to 4.3.17-150400.3.151.1
spacecmd - addressed in versions 5.0.15-150000.3.142.1, 5.2.6-159000.4.3.1
supportutils-plugin-susemanager-client - update to 5.2.2-159000.4.2.1
python3-mgr-push - update to 5.2.3-159000.2.3.1
mgr-push - update to 5.2.3-159000.2.3.1
python3-uyuni-common-libs - update to 5.2.3-159000.2.3.1
python3-spacewalk-client-tools - update to 5.2.4-159000.4.3.1
spacewalk-client-tools - update to 5.2.4-159000.4.3.1
python3-rhnlib - update to 5.2.4-159000.4.3.1
Multi-Linux-ManagerTools-Beta-SLE-Micro-release - update to 5-159000.3.3.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
App Connect Enterprise Certified Container - addressed in versions 12.0.21, 12.21.0
venv-salt-minion - update to 3006.0-159000.5.3.2

External References

Related Security Bulletins