Is CVE-2026-12208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12208 being exploited in the wild.

How severe is CVE-2026-12208?

Medium severity, with a CVSS score of 5.3, published 15 June 2026.

Which products and versions are affected?

JSONata up to 2.2.0; jsonata (npm) SEMVER:introduced=0,fixed=1.8.8.

Is there a fix for CVE-2026-12208?

Yes. jsonata (npm): upgrade to 1.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12208 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12208?

Check whether you run JSONata or jsonata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12208: JSONata prototype pollution in createFrame function

CVE-2026-12208 · Severity: medium · CVSS 5.3 · Published 2026-06-15

jsonata is a JavaScript query language used to transform and query JSON data in applications. A flaw in its function binding system allows remote attackers to modify JavaScript object prototypes without authentication, potentially enabling them to inject malicious code or alter application behavior for all users of the library.

Technologies: JSONata, jsonata (npm). Vendors: JSONata, npm.

Quick answers

Is CVE-2026-12208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12208 being exploited in the wild.
How severe is CVE-2026-12208?: Medium severity, with a CVSS score of 5.3, published 15 June 2026.
Which products and versions are affected?: JSONata up to 2.2.0; jsonata (npm) SEMVER:introduced=0,fixed=1.8.8.
Is there a fix for CVE-2026-12208?: Yes. jsonata (npm): upgrade to 1.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12208 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12208?: Check whether you run JSONata or jsonata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsonata (npm): upgrade to 1.8.8 or later
```
npm install jsonata@1.8.8
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-94) in the createFrame function of src/jsonata.js. By overriding the hasOwnProperty property, an attacker can manipulate the prototype chain and inject malicious code. The attack requires no authentication or user interaction and can be initiated remotely over a network. An attacker can achieve unauthorized modification of object properties and potentially execute arbitrary code in the context of applications using jsonata. Patches are available: upgrade to version 1.8.8 (for the 1.x branch) or 2.2.1 (for the 2.x branch).

Affected products

jsonata-js jsonata < 1.8.8
jsonata-js jsonata >= 2.0.0, < 2.2.1

Identifiers

CVE-2026-12208
GHSA-663r-x48j-fg8p

Timeline

2026-06-15: disclosed: Published to GitHub Advisory Database
2026-06-15: patched: Patches released in versions 1.8.8 and 2.2.1
2026-09-08: other: GitHub reviewed and updated advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.