Executive brief
JSONata is a JavaScript library used to query and transform JSON data. Due to missing input validation in the lookup function, an attacker can craft specially designed JSONata expressions that execute arbitrary code on the system running the application. This allows complete compromise of any application using vulnerable versions of JSONata.
Technical details
The vulnerability is a code injection flaw (CWE-94) in JSONata's lookup function that fails to properly validate expressions before evaluation. The root cause is a missing hasOwnProperty check at lines 1686-1705 of functions.js, which allows attackers to access and manipulate prototype objects via __proto__ and constructor gadgets. An attacker can craft a JSONata expression that bypasses sandbox restrictions and executes arbitrary shell commands through process.getBuiltinModule('child_process'). The attack requires only the ability to provide input to the jsonata() expression parser—no prior authentication or privileges are required. The vulnerability affects JSONata versions up to 1.8.7 and 2.0.0–2.1.x, and is patched in versions 1.8.8 and 2.2.0.
Affected products
- JSONata JS JSONata <= 1.8.7, >= 2.0.0 and < 2.2.0
Timeline
- 2026-07-13: disclosed
- 2026-08-21: patched: Versions 1.8.8 and 2.2.0 released with fix
- 2026-08-21: advisory: GitHub Advisory Database published