Remote code execution security vulnerability

[milandamen]

If an attacker can influence the json path expression, they can trivially run arbitrary code on your server.

Example expressions:

$[(phpinfo())]

$[?(phpinfo())]

The string phpinfo() can be replaced with any PHP code.

I hope nobody is still using this library.
We switched to https://github.com/Galbar/JsonPath-PHP which does not have this problem, as it does not use PHP's eval() function.