Critical PHP Code Injection Patched in jmespath.php's CompilerRuntime (CVE-2026-54133)

A critical security advisory (GHSA-pcw8-m77r-2528) discloses a code injection vulnerability in mtdowling/jmespath.php, the PHP implementation of the JMESPath query language, tracked as CVE-2026-54133 with a CVSS score of 9.8 and a public proof-of-concept.

What Happened

According to the advisory, JmesPath\CompilerRuntime generates PHP source code from parsed JMESPath expressions and writes it to a cache file, which is then loaded and executed. The compiler emits function names from the parsed expression into that generated PHP source without adequately escaping them as string literals. A crafted expression can exploit this by supplying a non-identifier value where the parser expects a function callee, injecting attacker-controlled PHP into the generated cache file. When that file is loaded by CompilerRuntime, the injected code executes with the privileges of the PHP process.

The advisory notes the default runtime, AstRuntime (used by JmesPath\search()), interprets the expression tree directly and is not affected unless the JP_PHP_COMPILE flag is enabled. Exploitation requires the attacker to control the JMESPath expression string itself — the data document being searched is not sufficient on its own.

Why It Matters

Applications are exposed when they explicitly instantiate JmesPath\CompilerRuntime, enable JP_PHP_COMPILE as a performance optimization, and allow users to supply JMESPath expressions for filtering, querying, or transforming data — a pattern seen in APIs, admin tooling, and data-transformation services built on Composer-managed PHP stacks. Given the 9.8 CVSS score and a public PoC, any internet-facing service matching this pattern should be treated as an immediate remote code execution risk.

What Defenders Should Do Now

• Inventory PHP applications for a dependency on mtdowling/jmespath.php and check whether they instantiate CompilerRuntime directly or set JP_PHP_COMPILE.
• Upgrade to 2.9.1 or later, where the issue is patched.
• If immediate upgrade isn't possible, disable JP_PHP_COMPILE and avoid using CompilerRuntime with any expression that originates from user input; use the default AstRuntime for untrusted expressions instead.
• For hunting, review any code paths that accept user-supplied JMESPath filter/query strings, and audit the compiled-expression cache directory (if configured) for unexpected or recently modified PHP files.
• Monitor application logs for anomalous JMESPath expressions containing unusual characters or non-identifier tokens in function-callee position.

This is developing intel based on a same-day GHSA disclosure; details on real-world exploitation are not yet established. See the original advisory for full technical detail: GHSA-pcw8-m77r-2528.