CVE-2026-77415
CRITICAL
9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
94
Improper Control of Generation of Code ('Code Injection')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Availability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted
Technologies:
AI/ML
https://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fca…
https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c…
https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1f…
https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb870…
https://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e8140…
https://github.com/jsonata-js/jsonata/pull/799
https://github.com/jsonata-js/jsonata/pull/800
https://github.com/jsonata-js/jsonata/pull/802
https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8
https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1
https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff