AIKIDO-2026-928289

TL;DR

mtdowling/jmespath.php emits parsed JMESPath function names into generated PHP source without safely escaping them as string literals when JmesPath\CompilerRuntime is used (or when JP_PHP_COMPILE is enabled). A crafted expression using a non-identifier function callee can break out of the generated string literal and write attacker-controlled PHP into the compiled-expression cache file, which the compiler runtime then loads and executes. This allows arbitrary PHP code execution with the privileges of the PHP process when an attacker can influence the expression string. The fix escapes function names with var_export() and rejects non-identifier function callees in the parser.