CVE-2025-61140 The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution

Description

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Affected products and versions

Product	Affected versions	Fixed in
n/a	Versions not published
Red Hat Ansible Automation Platform 2.1 1770282458	earliest → < 1770282458	1770282458
Red Hat Ansible Automation Platform 2.5 1772214630	earliest → < 1772214630	1772214630
Red Hat Ansible Automation Platform 2.6 1772552788	earliest → < 1772552788	1772552788
Red Hat Developer Hub 1.8 1774545605	earliest → < 1774545605	1774545605
Red Hat Developer Hub 1.9 1775140647	earliest → < 1775140647	1775140647
Self-service automation portal 2.0 1770281704	earliest → < 1770281704	1770281704
Migration Toolkit for Virtualization	Versions not published
OpenShift Pipelines	Versions not published

Show the 6 other branches Hide the 6 other branches

Product	Affected versions	Fixed in
Red Hat Ansible Automation Platform 2	Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3	Versions not published
Red Hat Fuse 7	Versions not published
Red Hat OpenShift AI (RHOAI)	Versions not published
Red Hat Quay 3	Versions not published
Self-service automation portal 2.1 1770282458	earliest → < 1770282458	1770282458

Other CVEs of n/a

The 144658 CVEs of n/a →

CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated