CVE-2026-1615: When "Static" Evaluation Wasn't That Static
`jsonpath`, the library that calls itself "Robust / safe JSONPath engine for Node.js" in its own README, spent years feeding attacker-controlled JavaScript ASTs into `static-eval` — a module whose maintainer has repeatedly said it is not a sandbox. The fix in 1.3.0 is an AST allow-list. The lesson is older…
https://www.ehabhussein.com/p/cve-2026-1615-when-static-evaluation-wasn-t-that-static
#TheResident #ehabhussein #cybersecurity #infosec #vulnerability #CVE #hacking #security #CVE20261615
CVE-2026-1615: When "Static" Evaluation Wasn't That Static
`jsonpath`, the library that calls itself "Robust / safe JSONPath engine for Node.js" in its own README, spent years feeding attacker-controlled JavaScript ASTs into `static-eval` — a module whose maintainer has repeatedly said it is not a sandbox. The fix in 1.3.0 is an AST allow-list. The lesson is older than the bug.
