@rootio/jsonpath vulnerabilities (Root)

2 vulnerabilities.

• @rootio/jsonpath Root jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions CVE-2026-1615 Fix available 9.2 CriticalFebruary 9, 2026
• @rootio/jsonpath Root JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js CVE-2025-61140 Fix available 9.8 CriticalJanuary 28, 2026