Detect CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names in Sumo Logic CSE
Detects exploitation and presence of CVE-2026-54133, a CVSS 9.8 code injection (CWE-94) vulnerability in mtdowling/jmespath.php prior to version 2.9.1. The library's CompilerRuntime writes compiled PHP expression code to disk and includes it. Function names supplied within a JMESPath expression are not properly escaped/sanitized before being emitted into the generated PHP source, allowing an attacker who controls the JMESPath expression (or a function name within it) to inject arbitrary PHP that is then written to the compiler cache directory and executed via include. Detection focuses on suspicious writes to the jmespath compiler cache directory (typically system temp with jmespath_* filenames), anomalous PHP process behavior downstream of JMESPath usage, and web requests carrying JMESPath-like injection payloads.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Sumo Detection Query
(_sourceCategory=*endpoint* OR _sourceCategory=*sysmon* OR _sourceCategory=*linux*) ("jmespath_" OR "shell_exec" OR "system(" OR "eval(")
| where (filename matches /(?i)jmespath_.*\.php/) or (process_name matches /(?i).*php.*/ and (command_line matches /.*system\(.*/ or command_line matches /.*shell_exec\(.*/ or command_line matches /.*passthru\(.*/ or command_line matches /.*eval\(.*/ or command_line matches /.*base64_decode\(.*/))
| count by host, filename, process_name, command_line, user
| sort by _countAggregates jmespath compiler-cache writes and suspicious PHP command execution per host to identify CVE-2026-54133 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Applications legitimately compiling JMESPath expressions.
- Developer workstations running PHP tooling.
- Log-forwarding of test-environment artifacts.
Other platforms for CVE-2026-54133
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malicious jmespath compiler-cache file write
Expected signal: File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.
- Test 2Execute injected PHP compiler-cache payload
Expected signal: PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.
- Test 3Vulnerable jmespath.php code-injection PoC (lab)
Expected signal: jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.
Response Playbook
Triage
- Confirm whether mtdowling/jmespath.php is a dependency of the affected host's PHP application and identify its installed version via `composer show mtdowling/jmespath.php` or by inspecting composer.lock — versions < 2.9.1 are vulnerable.
- Inspect the jmespath compiler cache directory (default sys_get_temp_dir(), e.g. /tmp or the OS temp path) for jmespath_*.php files and read their contents for injected PHP (calls to system/exec/shell_exec/eval/base64_decode or unexpected function-name-derived code).
- Determine whether the application passes user-controlled input into JMESPath expressions or function names, and review web/application logs for requests carrying JMESPath-like payloads around the file-write timestamps.
- Correlate the file-write events with downstream PHP process executions to establish whether injected code actually executed.
Containment
- Isolate the affected host from the network if injected code execution is confirmed, and suspend the exposed application/endpoint accepting attacker-controlled JMESPath input.
- Delete malicious jmespath_*.php cache files and rotate any credentials, tokens, or secrets accessible to the PHP process (web app service account, DB creds, API keys).
- Block the source IPs delivering the injection payloads at the WAF/edge and disable CompilerRuntime (use AstRuntime) until patched.
Evidence Collection
- Preserve the contents and metadata (timestamps, ownership) of all jmespath_*.php files in the compiler cache directory before deletion.
- Collect web server access/error logs, PHP-FPM logs, and application logs covering the exploitation window along with process-execution telemetry (Sysmon/auditd/EDR).
Escalation Criteria
- !Escalate to incident response if any jmespath_*.php cache file contains injected OS-command or eval primitives, or if correlated PHP command execution is observed.
- !Escalate if the affected application is internet-facing and accepts untrusted JMESPath expressions, or if evidence of lateral movement, data exfiltration, or credential theft from the PHP host is found.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
jmespath_*.php files in the system temp / compiler cache directory (contents, mtime, owner). - >
Web server and PHP-FPM access/error logs showing the malicious request and JMESPath payload. - >
EDR/Sysmon/auditd records of PHP process spawns invoking command or eval primitives. - >
composer.lock entry confirming vulnerable mtdowling/jmespath.php version < 2.9.1.
Tuning Guidance
Baseline the normal set of jmespath_*.php filenames and cache directories produced by your legitimate applications during a known-good period; alert only on cache files whose contents contain OS-command or eval primitives, or on cache writes correlated with suspicious PHP process execution. In environments that use AstRuntime (no on-disk compilation) or have upgraded to >= 2.9.1, the file-write leg should never fire and can be treated as high-fidelity. Suppress developer/CI hosts by asset group to reduce noise from test artifacts.
Hunting Queries
Enumerate all hosts that have written jmespath.php compiler-cache files, then manually inspect each file's contents for injected code.
DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php" | join kind=inner (DeviceFileEvents | where FileName matches regex @"(?i)jmespath_.*\.php") on DeviceName | summarize count(), makeset(FolderPath) by DeviceName, FileNameindex=* (TargetFilename="*jmespath_*.php" OR file_path="*jmespath_*.php") | stats count values(TargetFilename) values(file_path) by host | where count > 0Atomic Red Team Tests
Writes a jmespath_*.php file containing an injected command primitive into the temp directory to emulate the artifact produced by CVE-2026-54133 exploitation.
Command
printf '<?php system("id"); // injected via unescaped function name\n' > "/tmp/jmespath_$(printf %04d 1).php" && cat "/tmp/jmespath_0001.php"Cleanup
rm -f /tmp/jmespath_0001.phpExpected Telemetry
File creation event for /tmp/jmespath_0001.php with .php extension in the temp directory.
Expected Detection
KQL/EQL/CQL file-write rules match on jmespath_*.php in a temp path; contents contain a command primitive.
Executes a jmespath-style compiler-cache PHP file that invokes a shell command, emulating the include of injected code by CompilerRuntime.
Command
printf '<?php echo shell_exec("whoami");\n' > /tmp/jmespath_test.php && php /tmp/jmespath_test.phpCleanup
rm -f /tmp/jmespath_test.phpExpected Telemetry
PHP process launch with command line referencing jmespath_test.php and a child shell/whoami execution.
Expected Detection
Process-execution rules match PHP invoking shell_exec/command primitives correlated with the cache-file write.
Runs a PHP snippet using CompilerRuntime with an attacker-influenced function name to demonstrate code injection on a vulnerable mtdowling/jmespath.php < 2.9.1 install in an isolated lab.
Command
php -r 'require "vendor/autoload.php"; $r = new \\JmesPath\\CompilerRuntime(sys_get_temp_dir()); echo $r("malicious_fn(@)", ["a"=>1]);' 2>&1 | head -n 20Cleanup
rm -f /tmp/jmespath_*.phpExpected Telemetry
jmespath_*.php file written to sys_get_temp_dir(); PHP process may spawn a shell if injection succeeds.
Expected Detection
Correlated file-write plus PHP command-primitive execution alerts fire; cache file contents reveal the injected function name.