jmespath.php has CompilerRuntime code injection via unescaped function names
mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. A vulnerable flow is: An application accepts or constructs a JMESPath expression using attacker-controlled input. The expression …