CVE-2025-61140

CriticalCVSS 9.8/10Last modified Sep 7, 2026

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2026
Last modified
Sep 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-611417.5sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environmeCVE-2025-611435.5libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.CVE-2025-611447.3libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.CVE-2025-611455.0libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.CVE-2025-611464.0saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.CVE-2025-611476.2strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(CVE-2025-611486.5An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to accessCVE-2025-61158.8A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The CVE-2025-611526.5python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A maliCVE-2025-611546.5Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of ServiCVE-2025-611555.5The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL hanCVE-2025-611567.8Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arb
CVE-2025-61140: Critical severity, CVSS 9.8 | Vulnix