Code Injection in jsonpath - CVE-2026-1615

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123311

Code Injection in jsonpath - CVE-2026-1615

Published: February 27, 2026


Vulnerability identifier: #VU123311
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-1615
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to unsafe evaluation of user-supplied JSON Path expressions. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.


Affected software

jsonpath
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Multi-Linux Manager Beta Client Tools for SLE Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Multi-Linux Manager Beta Client Tools for SLE
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
IBM Sterling Secure Proxy
App Connect Enterprise Certified Container
IBM App Connect Enterprise
mgrctl
mgrctl-lang
mgrctl-zsh-completion
mgrctl-bash-completion
mgrctl-debuginfo
firewalld-prometheus-config
dracut-wireless
golang-github-QubitProducts-exporter_exporter
python3-defusedxml
prometheus-postgres_exporter
prometheus-postgres_exporter-debuginfo
golang-github-prometheus-promu-debuginfo
golang-github-prometheus-promu
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager
golang-github-prometheus-alertmanager-debuginfo
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
supportutils-plugin-salt
golang-github-prometheus-node_exporter-debuginfo
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
golang-github-prometheus-prometheus
golang-github-prometheus-prometheus-debuginfo
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
supportutils-plugin-susemanager-client
python3-uyuni-common-libs
python3-mgr-push
mgr-push
python3-rhnlib
python3-spacewalk-client-tools
spacewalk-client-tools
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
grafana-debuginfo
grafana
venv-salt-minion

How to mitigate CVE-2026-1615

Install updates from vendor's website.

jsonpath - update to 1.2.0
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.6.2
mgrctl - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-lang - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-zsh-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-bash-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-debuginfo - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
firewalld-prometheus-config - addressed in versions 0.1-150000.3.67.1, 0.1-159000.4.3.2
dracut-wireless - update to 0.1.1595937550.0285244-159000.2.2.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.21.1, 0.4.0-159000.2.2.1
python3-defusedxml - update to 0.7.1-159000.4.2.1
prometheus-postgres_exporter - update to 0.10.1-159000.2.2.1
prometheus-postgres_exporter-debuginfo - update to 0.10.1-159000.2.2.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - addressed in versions 0.26.0-150000.1.30.2, 0.26.0-159000.2.2.1
golang-github-prometheus-alertmanager - update to 0.28.1-159000.12.2.1
golang-github-prometheus-alertmanager-debuginfo - update to 0.28.1-159000.12.2.1
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
golang-github-lusitaniae-apache_exporter-debuginfo - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
dracut-saltboot - addressed in versions 1.1.0-150000.1.65.1, 1.1.0-159000.2.2.1
supportutils-plugin-salt - update to 1.2.3-159000.4.2.1
golang-github-prometheus-node_exporter-debuginfo - update to 1.9.1-159000.4.2.1
golang-github-prometheus-node_exporter - update to 1.9.1-159000.4.2.1
golang-github-boynux-squid_exporter - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-boynux-squid_exporter-debuginfo - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-prometheus-prometheus - addressed in versions 3.5.0-150000.3.67.1, 3.5.0-159000.4.3.2
golang-github-prometheus-prometheus-debuginfo - update to 3.5.0-159000.4.3.2
release-notes-susemanager-proxy - update to 4.3.17-150400.3.107.1
release-notes-susemanager - update to 4.3.17-150400.3.151.1
spacecmd - addressed in versions 5.0.15-150000.3.142.1, 5.2.6-159000.4.3.1
supportutils-plugin-susemanager-client - update to 5.2.2-159000.4.2.1
python3-uyuni-common-libs - update to 5.2.3-159000.2.3.1
python3-mgr-push - update to 5.2.3-159000.2.3.1
mgr-push - update to 5.2.3-159000.2.3.1
python3-rhnlib - update to 5.2.4-159000.4.3.1
python3-spacewalk-client-tools - update to 5.2.4-159000.4.3.1
spacewalk-client-tools - update to 5.2.4-159000.4.3.1
Multi-Linux-ManagerTools-Beta-SLE-Micro-release - update to 5-159000.3.3.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 12.21.0
venv-salt-minion - update to 3006.0-159000.5.3.2

External References

Related Security Bulletins