The vulnerability originates in the jmespath.php library. Versions older than 2.9.1 compile JMESPath expressions into PHP source that is then executed by the runtime. Because function names from the expression are written into the generated file without escaping, an attacker who can influence the expression can insert arbitrary PHP code. The flaw allows execution of attacker‑controlled code, giving full code‑execution capabilities on the server. The weakness involves code‑generation, input validation and code injection, reflected in the CWE identifiers.

Affected installations are those that include the jmespath.php package from the jmespath vendor with a version less than 2.9.1. Any PHP application that imports this library and uses JmesPath\CompilerRuntime to evaluate untrusted expressions is exposed. The issue remains if JP_PHP_COMPILE is enabled and the compiler runtime processes the expression.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score is unknown, reducing certainty about current exploitation rates, but the vulnerability is not recorded in the CISA KEV catalog, indicating no publicly confirmed exploitation yet. Nonetheless, because the flaw permits remote code execution via crafted JMESPath expressions, it is highly actionable. The attack vector is likely remote, through any endpoint or service that accepts untrusted JMESPath expressions from users.