CVE-2026-54133

CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names

Initial Access Execution Last updated:

Detects exploitation and presence of CVE-2026-54133, a CVSS 9.8 code injection (CWE-94) vulnerability in mtdowling/jmespath.php prior to version 2.9.1. The library's CompilerRuntime writes compiled PHP expression code to disk and includes it. Function names supplied within a JMESPath expression are not properly escaped/sanitized before being emitted into the generated PHP source, allowing an attacker who controls the JMESPath expression (or a function name within it) to inject arbitrary PHP that is then written to the compiler cache directory and executed via include. Detection focuses on suspicious writes to the jmespath compiler cache directory (typically system temp with jmespath_* filenames), anomalous PHP process behavior downstream of JMESPath usage, and web requests carrying JMESPath-like injection payloads.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
composer
Product
mtdowling/jmespath.php
Versions
< 2.9.1

Weakness (CWE)

CWE-20CWE-94CWE-116

Timeline

Disclosed
August 18, 2026

CVSS

9.8
Critical (9.0–10)
CVSS vector not yet published
Write-up coming soon

What is CVE-2026-54133 CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names?

CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names (CVE-2026-54133) maps to the Initial Access and Execution tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, DeviceFileEvents, DeviceProcessEvents. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution
Microsoft Sentinel / Defender
kusto 
// Suspicious PHP compiler-cache writes and injected code execution for jmespath.php (CVE-2026-54133)
let suspiciousCache = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("jmespath", "/tmp", "\\Temp\\", "/var/tmp", "sys_get_temp_dir")
| where FileName matches regex @"(?i)jmespath_.*\.php"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
suspiciousCache
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName has_any ("php", "php-fpm", "apache2", "httpd", "nginx")
    | where ProcessCommandLine has_any ("system(", "exec(", "passthru(", "shell_exec(", "proc_open(", "base64_decode(", "eval(")
    | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName
) on DeviceName
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine

Correlates writes of jmespath_*.php compiler-cache files in temp directories with downstream PHP process execution invoking OS command primitives — the signature of injected code being compiled and executed.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint DeviceFileEvents DeviceProcessEvents

Required Tables

DeviceFileEvents DeviceProcessEvents

False Positives

  • Legitimate jmespath.php usage that compiles expressions to the cache directory during normal application operation (benign jmespath_*.php files without injected primitives).
  • Developer or CI environments that write PHP files to temp directories during test runs.
  • Security scanners or SAST tools that emit crafted PHP files into temp paths for analysis.

Sigma rule & cross-platform mapping

The detection logic for CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names (CVE-2026-54133) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-54133 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-54133

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-08-24 Research depth: standard
References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate malicious jmespath compiler-cache file write

    Expected signal: File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.

  2. Test 2Execute injected PHP compiler-cache payload

    Expected signal: PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.

  3. Test 3Vulnerable jmespath.php code-injection PoC (lab)

    Expected signal: jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.

Response Playbook

Triage

  1. Confirm whether mtdowling/jmespath.php is a dependency of the affected host's PHP application and identify its installed version via `composer show mtdowling/jmespath.php` or by inspecting composer.lock — versions < 2.9.1 are vulnerable.
  2. Inspect the jmespath compiler cache directory (default sys_get_temp_dir(), e.g. /tmp or the OS temp path) for jmespath_*.php files and read their contents for injected PHP (calls to system/exec/shell_exec/eval/base64_decode or unexpected function-name-derived code).
  3. Determine whether the application passes user-controlled input into JMESPath expressions or function names, and review web/application logs for requests carrying JMESPath-like payloads around the file-write timestamps.
  4. Correlate the file-write events with downstream PHP process executions to establish whether injected code actually executed.

Containment

  1. Isolate the affected host from the network if injected code execution is confirmed, and suspend the exposed application/endpoint accepting attacker-controlled JMESPath input.
  2. Delete malicious jmespath_*.php cache files and rotate any credentials, tokens, or secrets accessible to the PHP process (web app service account, DB creds, API keys).
  3. Block the source IPs delivering the injection payloads at the WAF/edge and disable CompilerRuntime (use AstRuntime) until patched.

Evidence Collection

  1. Preserve the contents and metadata (timestamps, ownership) of all jmespath_*.php files in the compiler cache directory before deletion.
  2. Collect web server access/error logs, PHP-FPM logs, and application logs covering the exploitation window along with process-execution telemetry (Sysmon/auditd/EDR).

Escalation Criteria

  • ! Escalate to incident response if any jmespath_*.php cache file contains injected OS-command or eval primitives, or if correlated PHP command execution is observed.
  • ! Escalate if the affected application is internet-facing and accepts untrusted JMESPath expressions, or if evidence of lateral movement, data exfiltration, or credential theft from the PHP host is found.

Investigation Guide

Forensic Artifacts

  • > jmespath_*.php files in the system temp / compiler cache directory (contents, mtime, owner).
  • > Web server and PHP-FPM access/error logs showing the malicious request and JMESPath payload.
  • > EDR/Sysmon/auditd records of PHP process spawns invoking command or eval primitives.
  • > composer.lock entry confirming vulnerable mtdowling/jmespath.php version < 2.9.1.

Tuning Guidance

Baseline the normal set of jmespath_*.php filenames and cache directories produced by your legitimate applications during a known-good period; alert only on cache files whose contents contain OS-command or eval primitives, or on cache writes correlated with suspicious PHP process execution. In environments that use AstRuntime (no on-disk compilation) or have upgraded to >= 2.9.1, the file-write leg should never fire and can be treated as high-fidelity. Suppress developer/CI hosts by asset group to reduce noise from test artifacts.

Hunting Queries

Enumerate all hosts that have written jmespath.php compiler-cache files, then manually inspect each file's contents for injected code.

Hunting — KQL
kql 
DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php" | join kind=inner (DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php") on DeviceName | summarize count(), makeset(FolderPath) by DeviceName, FileName
Hunting — SPL
spl 
index=* (TargetFilename="*jmespath_*.php" OR file_path="*jmespath_*.php") | stats count values(TargetFilename) values(file_path) by host | where count > 0

Atomic Red Team Tests

Test 1 Simulate malicious jmespath compiler-cache file write
linux

Writes a jmespath_*.php file containing an injected command primitive into the temp directory to emulate the artifact produced by CVE-2026-54133 exploitation.

Command

bash 
printf '<?php system("id"); // injected via unescaped function name\n' > "/tmp/jmespath_$(printf %04d 1).php" && cat "/tmp/jmespath_0001.php"

Cleanup

bash 
rm -f /tmp/jmespath_0001.php

Expected Telemetry

File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.

Expected Detection

KQL/EQL/CQL file-write rules match on jmespath_*.php in a temp path; contents contain a command primitive.

Test 2 Execute injected PHP compiler-cache payload
linux

Executes a jmespath-style compiler-cache PHP file that invokes a shell command, emulating the include of injected code by CompilerRuntime.

Command

bash 
printf '<?php echo shell_exec("whoami");\n' > /tmp/jmespath_test.php && php /tmp/jmespath_test.php

Cleanup

bash 
rm -f /tmp/jmespath_test.php

Expected Telemetry

PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.

Expected Detection

Process-execution rules match PHP invoking shell_exec/command primitives correlated with the cache-file write.

Test 3 Vulnerable jmespath.php code-injection PoC (lab)
linux

Runs a PHP snippet using CompilerRuntime with an attacker-influenced function name to demonstrate code injection on a vulnerable mtdowling/jmespath.php < 2.9.1 install in an isolated lab.

Command

bash 
php -r 'require "vendor/autoload.php"; $r = new \\JmesPath\\CompilerRuntime(sys_get_temp_dir()); echo $r("malicious_fn(@)", ["a"=>1]);' 2>&1 | head -n 20

Cleanup

bash 
rm -f /tmp/jmespath_*.php

Expected Telemetry

jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.

Expected Detection

Correlated file-write plus PHP command-primitive execution alerts fire; cache file contents reveal the injected function name.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections