Executive brief
JSONata is a popular JavaScript library used to query and transform JSON data. A critical flaw in versions before 2.2.1 and 1.8.8 allows attackers to execute arbitrary code by crafting malicious JSONata expressions that bypass security restrictions. This could allow an attacker to compromise any application that processes untrusted JSONata expressions, leading to unauthorized access to sensitive data, system commands execution, or complete server compromise.
Technical details
The vulnerability exists in the environment.lookup function's bypassable hasOwnProperty check (CVE-2026-77414, CWE-94: Code Injection). An attacker can craft expressions using prototype pollution techniques—reassigning $hasOwnProperty, $__proto__, and $constructor variables to circumvent security protections—and then execute arbitrary Node.js code via the constructor function. The attack requires no authentication and can be triggered by evaluating any untrusted JSONata expression. The vulnerability was patched in JSONata 2.2.1 and backported to 1.8.8 in PR #799. A working proof-of-concept demonstrates spawning shell commands via process.getBuiltinModule('child_process').execSync().
Affected products
- jsonata-js jsonata >=2.0.0, <2.2.1; <1.8.8
Timeline
- 2026-07-13: disclosed: Advisory published by GitHub
- 2026-07-13: patched: Patched in JSONata 2.2.1 and 1.8.8
- 2026-08-21: advisory: Advisory updated on GitHub