CVE-2026-77414
JSONata: Arbitrary Code Execution via crafted JSONata expressions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
| CWE | CWE-94 |
| Vendor | jsonata-js |
| Product | jsonata |
| Published | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for jsonata-js jsonata
Be the first to know when new unknown vulnerabilities affecting jsonata-js jsonata are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
jsonata-js / jsonata
< 1.8.8 >= 2.0.0, < 2.2.1
References
github.com: https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f github.com: https://github.com/jsonata-js/jsonata/pull/799 github.com: https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2 github.com: https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8 github.com: https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1