Every CVE Search/ Get API key

CVE-2026-1615

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

9.2 CriticalFix available

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.15%Up 0.9 points since Feb 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

Record
CVE-2026-1615
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-94
Updated
2026-11-02
EUVDEUVD-2026-6910 9.2

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

Record
EUVD-2026-6910
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-87r5-mp6g-5w5j 8.2

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Impact

Arbitrary Code Injection (Remote Code Execution & XSS):

A critical security vulnerability affects all versions of the jsonpath package. The library relies on the static-eval module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input.

This allows an attacker to inject arbitrary JavaScript code into the JSON Path expression. When the library evaluates this expression, the malicious code is executed.

  • Node.js Environments: This leads to Remote Code Execution (RCE), allowing an attacker to compromise the server.
  • Browser Environments: This leads to Cross-Site Scripting (XSS), allowing an attacker to hijack user sessions or exfiltrate data.

Affected Methods:

The vulnerability triggers when untrusted data is passed to any method that evaluates a path, including:

  • jsonpath.query
  • jsonpath.nodes
  • jsonpath.paths
  • jsonpath.value
  • jsonpath.parent
  • jsonpath.apply

Patches

No Patch Available:

Currently, all versions of jsonpath are vulnerable. There is no known patched version of this package that resolves the issue while retaining the current architecture.

Recommendation:

Developers are strongly advised to migrate to a secure alternative (such as jsonpath-plus or similar libraries that do not use eval/static-eval) or strictly validate all JSON Path inputs against a known allowlist.

Workarounds

  • Strict Input Validation: Ensure that no user-supplied data is ever passed directly to jsonpath functions.
  • Sanitization: If user input is unavoidable, implement a strict parser to reject any JSON Path expressions containing executable JavaScript syntax (e.g., parentheses (), script expressions script:, or function calls).

Resources

Record
GHSA-87r5-mp6g-5w5j
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
NVD 8.2

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

Record
CVE-2026-1615
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 8.2

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environments or Cross-site Scripting (XSS) in browser contexts. This affects all methods that evaluate JSON Paths against objects, including .query, .nodes, .paths, .value, .parent, and .apply.

Record
CVE-2026-1615
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-87r5-mp6g-5w5j 8.2

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Impact

Arbitrary Code Injection (Remote Code Execution & XSS):

A critical security vulnerability affects all versions of the jsonpath package. The library relies on the static-eval module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input.

This allows an attacker to inject arbitrary JavaScript code into the JSON Path expression. When the library evaluates this expression, the malicious code is executed.

  • Node.js Environments: This leads to Remote Code Execution (RCE), allowing an attacker to compromise the server.
  • Browser Environments: This leads to Cross-Site Scripting (XSS), allowing an attacker to hijack user sessions or exfiltrate data.

Affected Methods:

The vulnerability triggers when untrusted data is passed to any method that evaluates a path, including:

  • jsonpath.query
  • jsonpath.nodes
  • jsonpath.paths
  • jsonpath.value
  • jsonpath.parent
  • jsonpath.apply

Patches

No Patch Available:

Currently, all versions of jsonpath are vulnerable. There is no known patched version of this package that resolves the issue while retaining the current architecture.

Recommendation:

Developers are strongly advised to migrate to a secure alternative (such as jsonpath-plus or similar libraries that do not use eval/static-eval) or strictly validate all JSON Path inputs against a known allowlist.

Workarounds

  • Strict Input Validation: Ensure that no user-supplied data is ever passed directly to jsonpath functions.
  • Sanitization: If user input is unavoidable, implement a strict parser to reject any JSON Path expressions containing executable JavaScript syntax (e.g., parentheses (), script expressions script:, or function calls).

Resources

Record
GHSA-87r5-mp6g-5w5j
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1789672446 No score

TuxCare security update for jsonpath (2 CVEs)

TuxCare rebuilt jsonpath to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.

Record
CLSA-2026-1789672446
Updated
2026-11-02
OSVopenSUSE-SU-2026:20239-1 No score

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues:

  • CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)
  • CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)
  • CVE-2025-61140: Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)
Record
openSUSE-SU-2026:20239-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-1615 No score

CVE-2026-1615 in jsonpath - Patched by Root

Root has patched CVE-2026-1615 in the jsonpath package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-1615
Updated
2026-11-02
OSVSUSE-SU-2026:1008-1 No score

Security update for Prometheus

This update for Prometheus fixes the following issues:

golang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter:

  • Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
    • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
    • CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
    • CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)

  • Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):

    • Modernized Interface: Introduced a brand-new UI
    • Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support for more secure, native cloudauthentication.
    • Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental to a stable feature.
    • Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending data to external systems.
    • Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping operations.
    • Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier to troubleshoot why targets aren't reporting correctly.
    • Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were accidentally being scraped multiple times.
Record
SUSE-SU-2026:1008-1
Updated
2026-11-02
OSVSUSE-SU-2026:1013-1 No score

Security update 5.0.7 for Multi-Linux Manager Client Tools

This update fixes the following issues:

dracut-saltboot:

  • Version update to 1.1.0:

    • Retry DHCP requests up to 3 times (bsc#1253004)

golang-github-QubitProducts-exporter_exporter:

  • Non-customer-facing optimization and update

golang-github-boynux-squid_exporter:

  • Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):

    • Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path
    • Added TLS and Basic Authentication to the exporter’s web interface
    • Added support for the exporter to authenticate against the Squid proxy itself
    • Allow the gathering of process information without requiring root privileges
    • The exporter can now be configured using environment variables
    • Added support for custom labels to all exported metrics for better data filtering
    • New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred
    • Added 'service time' metrics to analyze proxy speed and performance.
    • Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks
    • Corrected the squid_client_http_requests_total metric to ensure accurate reporting

golang-github-lusitaniae-apache_exporter:

  • Version update from 1.0.8 to 1.0.10:

    • Updated github.com/prometheus/client_golang to 1.21.1
    • Updated github.com/prometheus/common to 0.63.0
    • Updated github.com/prometheus/exporter-toolkit to 0.14.0
    • Fixed signal handler logging

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
    • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
    • CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
    • CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)

  • Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):

    • Modernized Interface: Introduced a brand-new UI
    • Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support for more secure, native cloudauthentication.
    • Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental to a stable feature.
    • Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending data to external systems.
    • Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping operations
    • Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier to troubleshoot why targets aren't reporting correctly.
    • Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were accidentally being scraped multiple times

grafana:

  • Security issues fixed:

    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
    • CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
    • CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
    • CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)
    • CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)

  • Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:

    • Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface *…
Record
SUSE-SU-2026:1013-1
Updated
2026-11-02
OSVSUSE-SU-2026:1035-1 No score

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update

Record
SUSE-SU-2026:1035-1
Updated
2026-11-02
OSVSUSE-SU-2026:1148-1 No score

Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus:

  • CVE-2026-27606: Fix arbitrary file write via path traversal in rollup (bsc#1258893)
    • Bump rollup to version 4.59.0
  • Drop SLE 12 support (jsc#PED-15474)
  • CVE-2026-25547: Fix unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841):
    • Bump brace-expansion to version 5.0.2
  • Do not build old web UI. Fixes following security vulnerabilities:
    • CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions (bsc#1257897)
    • CVE-2025-61140: jsonpath: the value function is vulnerable to prototype pollution (bsc#1257442)
  • Set source URL in the spec file and drop tar service

grafana:

  • Drop support for SLE 12 (jsc#PED-15474)
  • Update to version 11.6.11: Features and enhancements:
    • Alerting: Add limits for the size of expanded notification templates
    • Correlations: Remove support for org_id=0 Security:
    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
  • Update to version 11.6.10:
    • API: Add missing scope check on dashboards
    • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
    • Alerting: Fix a race condition panic in ResetStateByRuleUID
  • Update to version 11.6.9:
    • Plugins: Add PluginContext to plugins when scenes is disabled
    • Alerting: Fix contacts point issues
  • Update to version 11.6.8:
    • Alerting: Fix unmarshalling of GettableStatus to include time intervals
  • Update to version 11.6.7:
    • Auth: Fix render user OAuth passthrough
    • LDAP Authentication: Fix URL to propagate username context as parameter
    • Plugins: Dependencies do not inherit parent URL for preinstall
    • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)
  • Update to version 11.6.6:
    • Alerting: Fix copying of recording rule fields
    • Fix redirection after login when Grafana is served from subpath
  • Update to version 11.6.5:
    • Alerting: Bump alerting package to include change to NewTLSClient
  • Update to version 11.6.4:
    • StateTimeline: Add endTime to tooltip
    • Unified storage: Respect GF_DATABASE_URL override
    • Alerting: Fix group interval override when adding new rules
    • Azure: Fix legend formatting
    • Azure: Fix resource name determination in template variable queries
    • Graphite: Fix annotation queries
    • Graphite: Fix date mutation
    • Graphite: Fix nested variable interpolation for repeated rows
  • Update to version 11.6.3:
    • Fixes CVE-2025-3415
  • Update to version 11.6.2:
    • Dashboard: Fixes issue with row repeats and first row
    • Graphite: Ensure template variables are interpolated correctly
    • Graphite: Fix Graphite series interpolation
    • Prometheus: Fix semver import path
  • Update to version 11.6.1:
    • DashboardScenePage: Correct slug in self referencing data links
    • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
    • Prometheus: Add support for cloud partners Prometheus data sources
    • Alertmanager: Add Role-Based Access Control via reqAction Field
    • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
    • InfluxDB: Fix nested variable interpolation
    • LDAP test: Fix page crash
    • Org redirection: Fix linking between orgs
  • Upgrade to version 11.6.0:
    • Visualisations: One click links and actions
    • Annotations: Add cron syntax support
    • WebGL-powered geomaps for better performance
    • Alerting: Add alert rule version history
    • API keys: Migrate API keys to service accounts at startup

mgr-push:

  • Version 5.2.3-0
    • Disable build for SLES 16

rhnlib:

  • Version 5.2.4-0
    • Disable build for SLES 16

spacecmd:

  • Version 5.2.6-0
    • Update translation strings

spacewalk-client-tools:

  • Version 5.2.4-0
    • Disable build for SLES 16

uyuni-common-libs:

  • Version 5.2.3-0 …
Record
SUSE-SU-2026:1148-1
Updated
2026-11-02
OSVSUSE-SU-2026:1524-1 No score

Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

  • Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bumped rollup to version 4.59.0
    • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
      • Bumped brace-expansion to version 5.0.2
    • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
    • CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bumped google.golang.org/grpc to version 1.79.3

grafana:

  • Security issues fixed:

    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
    • CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
    • CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
    • CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)
    • CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:

    • Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability
    • Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences
    • Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced
    • Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface
    • One-Click Actions: Visualizations now support faster navigation via one-click links and actions
    • Alerting History: Added version history for alert rules, allowing you to track changes over time
    • Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
    • Cron Support: Annotations now support Cron syntax for more flexible scheduling
    • Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath
    • Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting
    • Alerting Limits: Added size limits for expanded notification templates to prevent system strain
    • RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
    • Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries
    • Dashboard Reliability:
      • Fixed bugs involving row repeats and 'self-referencing' data links
      • Fixed a bug preventing single panels from…
Record
SUSE-SU-2026:1524-1
Updated
2026-11-02
OSVSUSE-SU-2026:20574-1 No score

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues:

  • CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)
  • CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)
  • CVE-2025-61140: Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)
Record
SUSE-SU-2026:20574-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jsonpath
npm
 through 1.2.1
1.3.0
jsonpath
TuxCare:npm
From an advisory covering 2 CVEs
 1.1.1-tuxcare.0 up to 1.1.1-tuxcare.1, plus listed versions
1.1.1
1.1.1-tuxcare.1
jsonpath
npm
 before 1.3.0
1.3.0
jsonpath
Root:npm
 before 1.2.0-aikido.1
1.2.0-aikido.11.1.1-aikido.11.2.1-aikido.1
@rootio/jsonpath
Root:npm
 before 1.2.0-root.io.1
1.2.0-root.io.11.1.1-root.io.11.2.1-root.io.1
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 15
From an advisory covering 5 CVEs
 before 0.28.1-150100.4.31.1
0.28.1-150100.4.31.1
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-alertmanager
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 0.28.1-150100.4.31.1
0.28.1-150100.4.31.1
golang-github-prometheus-prometheus
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 5 CVEs
 before 3.5.0-150100.4.29.1
3.5.0-150100.4.29.1
Show 70 moreShow less
Affected packages
PackageAffectedFixed
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-alertmanager
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 0.28.1-150100.4.31.1
0.28.1-150100.4.31.1
golang-github-prometheus-node_exporter
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 1.9.1-150100.3.38.1
1.9.1-150100.3.38.1
golang-github-prometheus-prometheus
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 3.5.0-150100.4.29.1
3.5.0-150100.4.29.1
dracut-saltboot
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 1.1.0-150000.1.65.1
1.1.0-150000.1.65.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 0.4.0-150000.1.21.1
0.4.0-150000.1.21.1
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 1.13.0-150000.1.12.1
1.13.0-150000.1.12.1
golang-github-lusitaniae-apache_exporter
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 1.0.10-150000.1.26.1
1.0.10-150000.1.26.1
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 3.5.0-150000.3.67.1
3.5.0-150000.3.67.1
grafana
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 11.6.11-150000.1.90.1
11.6.11-150000.1.90.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 0.26.0-150000.1.30.2
0.26.0-150000.1.30.2
spacecmd
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 5.0.15-150000.3.142.1
5.0.15-150000.3.142.1
uyuni-tools
SUSE:Manager Client Tools 15
From an advisory covering 11 CVEs
 before 0.1.38-150000.1.30.1
0.1.38-150000.1.30.1
dracut-saltboot
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 11 CVEs
 before 1.1.0-150000.1.65.1
1.1.0-150000.1.65.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 11 CVEs
 before 0.4.0-150000.1.21.1
0.4.0-150000.1.21.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 11 CVEs
 before 0.26.0-150000.1.30.2
0.26.0-150000.1.30.2
uyuni-tools
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 11 CVEs
 before 0.1.38-150000.1.30.1
0.1.38-150000.1.30.1
golang-github-prometheus-promu
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 11 CVEs
 before 0.17.0-150000.3.30.1
0.17.0-150000.3.30.1
dracut-saltboot
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 1.1.0-150000.1.65.1
1.1.0-150000.1.65.1
golang-github-QubitProducts-exporter_exporter
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 0.4.0-150000.1.21.1
0.4.0-150000.1.21.1
golang-github-boynux-squid_exporter
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 1.13.0-150000.1.12.1
1.13.0-150000.1.12.1
golang-github-lusitaniae-apache_exporter
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 1.0.10-150000.1.26.1
1.0.10-150000.1.26.1
golang-github-prometheus-promu
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 0.17.0-150000.3.30.1
0.17.0-150000.3.30.1
prometheus-blackbox_exporter
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 0.26.0-150000.1.30.2
0.26.0-150000.1.30.2
spacecmd
openSUSE:Leap 15.6
From an advisory covering 11 CVEs
 before 5.0.15-150000.3.142.1
5.0.15-150000.3.142.1
dracut-saltboot
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 1.1.0-159000.2.2.1
1.1.0-159000.2.2.1
dracut-wireless
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.1.1595937550.0285244-159000.2.2.1
0.1.1595937550.0285244-159000.2.2.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.4.0-159000.2.2.1
0.4.0-159000.2.2.1
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 1.13.0-159000.2.2.1
1.13.0-159000.2.2.1
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 1.0.10-159000.2.2.1
1.0.10-159000.2.2.1
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.28.1-159000.12.2.1
0.28.1-159000.12.2.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 1.9.1-159000.4.2.1
1.9.1-159000.4.2.1
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 3.5.0-159000.4.3.2
3.5.0-159000.4.3.2
grafana
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 11.6.11-159000.2.3.2
11.6.11-159000.2.3.2
mgr-push
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.3-159000.2.3.1
5.2.3-159000.2.3.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.26.0-159000.2.2.1
0.26.0-159000.2.2.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.10.1-159000.2.2.1
0.10.1-159000.2.2.1
python-defusedxml
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 0.7.1-159000.4.2.1
0.7.1-159000.4.2.1
rhnlib
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.4-159000.4.3.1
5.2.4-159000.4.3.1
spacecmd
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.6-159000.4.3.1
5.2.6-159000.4.3.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.4-159000.4.3.1
5.2.4-159000.4.3.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 1.2.3-159000.4.2.1
1.2.3-159000.4.2.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.2-159000.4.2.1
5.2.2-159000.4.2.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.3-159000.2.3.1
5.2.3-159000.2.3.1
uyuni-tools
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 5.2.5-159000.2.3.2
5.2.5-159000.2.3.2
venv-salt-minion
SUSE:Multi Linux Manager Tools Beta SLE-15
From an advisory covering 11 CVEs
 before 3006.0-159000.5.3.2
3006.0-159000.5.3.2
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 5-159000.3.3.1
5-159000.3.3.1
dracut-saltboot
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 1.1.0-159000.2.2.1
1.1.0-159000.2.2.1
dracut-wireless
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 0.1.1595937550.0285244-159000.2.2.1
0.1.1595937550.0285244-159000.2.2.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 1.9.1-159000.4.2.1
1.9.1-159000.4.2.1
uyuni-tools
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 5.2.5-159000.2.3.2
5.2.5-159000.2.3.2
venv-salt-minion
SUSE:Multi Linux Manager Tools Beta SLE-Micro-5
From an advisory covering 11 CVEs
 before 3006.0-159000.5.3.2
3006.0-159000.5.3.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 1.0.10-150002.3.6.1
1.0.10-150002.3.6.1
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 3.5.0-150002.3.8.1
3.5.0-150002.3.8.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 11.6.14+security01-150002.4.14.1
11.6.14+security01-150002.4.14.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.13-150002.3.9.3
5.1.13-150002.3.9.3
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
golang-github-prometheus-prometheus
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 3.5.0-160000.2.1
3.5.0-160000.2.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1615 is a critical vulnerability (CVSS 9.2) in Red Hat Migration Toolkit For Virtualization, published February 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in jsonpath 1.3.0.

References

Show 142 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open