p PatchFirst

CVE-2026-77413

CVE-2026-77413 · JSONata: Arbitrary Code Execution via crafted JSONata expressions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.

CVSS 9.3 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • jsonata

    Versions
    • < 2.2.0: Affected

    No fix published

  • jsonata npm

    Affected ranges
    • SEMVER: < 1.8.8

    Update to 1.8.8

  • jsonata npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.2.0

    Update to 2.2.0

Original sources

Check your server →