Executive brief
A vulnerability exists in JSONata, a popular library used for transforming and querying JSON data. An attacker can manipulate how the library handles internal variables to bypass security checks and replace built-in functions with malicious code. This could allow an attacker to alter data processing logic or disrupt the intended behavior of applications using this library.
Technical details
A prototype pollution vulnerability exists in the 'createFrame' function within 'src/jsonata.js'. The 'Function Binding Frame System' uses a plain JavaScript object for variable bindings and relies on 'bindings.hasOwnProperty(name)' as a security check during lookups. An attacker can provide a malicious binding named 'hasOwnProperty', which shadows the native method and returns 'true' for any property name. This bypasses the lookup protection, allowing the attacker to inject properties that override any of the 63 built-in JSONata functions (e.g., $sum, $eval). The vulnerability can be exploited remotely if the application allows user-supplied bindings to be passed to the JSONata evaluator.
Affected products
- JSONata jsonata-js up to 2.2.0
Timeline
- 2026-06-15: disclosed: Public disclosure of the vulnerability and PoC exploit.
- 2026-06-15: advisory: NVD and VulDB publish advisory details.