CVE-2026-77415 — JSONata: Arbitrary Code Execution via crafted JSONata expressions

Affected: jsonata-js jsonata

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.

GHSA-66mm-25pp-rfff — JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Affected: npm: jsonata

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: - overwriting `$clone` allowing mutation of objects via transforms (see [`evaluateTransformExpression`](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1304-L1314)) - it being possible to destruct jsonata functions/lambdas (e.g. `$merge.*`) - [applyProcedure](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1670C20-L1675) using `proc.arguments.forEach` and not `Array.prototype.forEach`

Which could be chained to execute arbitrary code.

This was fixed with:

- https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/changes#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1673-R1673) - https://github.com/jsonata-js/jsonata/pull/800 - https://github.com/jsonata-js/jsonata/pull/802

Which are included in the `2.2.1` release. Fixes were then back-ported to the `1.8.8` release.

## PoC

```js import jsonata from "jsonata";

const expression = jsonata(` ( $obj := {}; $clone := function($o) { $o }; $m := ($merge.*)[1];

$fn := function($a) { ( $a({"value":"lg"},"__lookupGetter__"); $a({"value":"x"},"x"); ) };

$nop := function() { $ };

$capture := function($val) { $obj ~> | $obj | {"x": 1, "y": 1, "lg":$lg} | };

$ ~> | $ | $m([$…

Most recent entries from all

CVE-2026-77415 — JSONata: Arbitrary Code Execution via crafted JSONata expressions

GHSA-66mm-25pp-rfff — JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions