JS Sandbox: JSONPath Expression Injection (CVE-2026-1615)

Bookmarked!

This exercise covers exploiting the jsonpath npm library which internally uses static-eval, via malicious JSONPath filter expressions.

Course

This exercise covers exploiting the jsonpath npm library which internally uses static-eval, via malicious JSONPath filter expressions.

Ready to practice?

Get access to this lab and 600+ hands-on exercises with a PRO subscription.