https://vulnerability.circl.lu/sightings/feed 2026-08-24T23:12:56.261129+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1bab4df7-2443-4e89-ba5e-b37d3780d623/export 2026-08-24T23:12:56.284131+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1bab4df7-2443-4e89-ba5e-b37d3780d623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77414", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtpz53xsi22d", "content": "Daily IT Security Digest \u2014 2026-08-22\nhttps://radar.offseq.com/threat/cve-2026-77413; https://radar.offseq.com/threat/cve-2026-77414-cwe-94; https://radar.offseq.com/threat/cve-2026-77415-cwe-94\n\n## 2. Microsoft August Patch Day: 22 Vulnerabilities Fixed, ShieldBreak Zero-Day", "creation_timestamp": "2026-08-23T05:02:19.205429Z"} 2026-08-23T05:02:19.205429+00:00 https://vulnerability.circl.lu/sighting/bba9ae9f-f6cd-47bb-ad56-87c674322938/export 2026-08-24T23:12:56.286172+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "bba9ae9f-f6cd-47bb-ad56-87c674322938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77414", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtpz53hn3h2s", "content": "Daily IT Security Digest \u2014 2026-08-22\nThree critical vulnerabilities (CVE-2026-77413, CVE-2026-77414, CVE-2026-77415) have been identified in the jsonata-js JavaScript library, with CVSS scores up to 9.3. The flaws involve code injection in the lookup function and object-integrity manipulation,", "creation_timestamp": "2026-08-23T05:02:18.523758Z"} 2026-08-23T05:02:18.523758+00:00 https://vulnerability.circl.lu/sighting/1a1952a6-b0df-4825-9c4b-82be2a0c07f0/export 2026-08-24T23:12:56.286292+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1a1952a6-b0df-4825-9c4b-82be2a0c07f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77414", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtnbualpi72n", "content": "CVE-2026-77414 in jsonata-js (<1.8.8, <2.2.1): CRITICAL code injection risk \u26a1\ufe0f \u2014 remote attackers can execute arbitrary code. Patch to 1.8.8/2.2.1 now. https://radar.offseq.com/threat/cve-2026-77414-cwe-94-improper-control-of-generation-of-code-code-injection-in-jsonata-js-jsonata-247817ff13af01b...", "creation_timestamp": "2026-08-22T03:00:27.355022Z"} 2026-08-22T03:00:27.355022+00:00 https://vulnerability.circl.lu/sighting/2986948b-d720-43bf-80ff-a0ec123e2882/export 2026-08-24T23:12:56.286390+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "2986948b-d720-43bf-80ff-a0ec123e2882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77414", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117136924619822381", "content": "CRITICAL: CVE-2026-77414 in jsonata-js (<1.8.8, <2.2.1) enables remote code execution via code injection (CWE-94). Update to 1.8.8/2.2.1 now. No workaround. Details: https://radar.offseq.com/threat/cve-2026-77414-cwe-94-improper-control-of-generation-of-code-code-injection-in-jsonata-js-jsonata-247817ff13af01bb #OffSeq #CVE202677414 #infosec #security", "creation_timestamp": "2026-08-22T03:00:24.883959Z"} 2026-08-22T03:00:24.883959+00:00 https://vulnerability.circl.lu/sighting/9f8e2884-b2c6-41f8-96b5-2dd74c6e7222/export 2026-08-24T23:12:56.286485+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9f8e2884-b2c6-41f8-96b5-2dd74c6e7222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77414", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmydmz5uq2f", "content": "CVE-2026-77414 - jsonata\nThe JSONata JavaScript library in versions earlier than 2.2.1 (and earlier than 1.8.8) can be tricked into running any command an attacker supplies. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jsonata #jsonatajs #npm #CVE #infosec", "creation_timestamp": "2026-08-22T00:10:05.185146Z"} 2026-08-22T00:10:05.185146+00:00 https://vulnerability.circl.lu/sighting/d3e79491-1a7d-45db-8c1f-c96bd1611722/export 2026-08-24T23:12:56.286587+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "d3e79491-1a7d-45db-8c1f-c96bd1611722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77414", "type": "published-proof-of-concept", "source": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f", "content": "", "creation_timestamp": "2026-08-21T22:35:05.924863Z"} 2026-08-21T22:35:05.924863+00:00 https://vulnerability.circl.lu/sighting/e227a751-4311-416a-90ae-b9499de66fd7/export 2026-08-24T23:12:56.287988+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e227a751-4311-416a-90ae-b9499de66fd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77414", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtmrjrjqer2m", "content": "\ud83d\udea8 CVE-2026-77414 \u2014 CVSS 9.3 CRITICAL\n\nJSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environme...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77414\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T22:08:39.637827Z"} 2026-08-21T22:08:39.637827+00:00 https://vulnerability.circl.lu/sighting/efbabe39-3886-4902-a9ba-e4b6a2f279f7/export 2026-08-24T23:12:56.288090+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "efbabe39-3886-4902-a9ba-e4b6a2f279f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77414", "type": "seen", "source": "https://gist.github.com/alon710/c3aaed90ea510257bc4b82da4dd81787", "content": "# CVE-2026-77414: CVE-2026-77414: Critical Sandbox Escape and Remote Code Execution in JSONata via Prototype Pollution\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77414\n\n## Summary\nCVE-2026-77414 (GHSA-2943-5xfg-gq5f) is a critical sandbox escape and remote code execution vulnerability in the JSONata package. When JSONata processes untrusted expressions, it uses a vulnerable environment lookup check that can be shadowed by user-defined variables. Attackers can leverage this to traverse the prototype chain, reach the global Function constructor, and execute arbitrary system commands on the host machine.\n\n## TL;DR\nA critical vulnerability in JSONata permits attackers to bypass query sandbox isolation and achieve remote code execution by shadowing local lookup methods and traversing the prototype chain.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network\n- **CVSS v4.0**: 9.3 (Critical)\n- **Impact**: Remote Code Execution (RCE) / Sandbox Escape\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- JSONata npm package versions < 1.8.8 and >= 2.0.0 < 2.2.1\n- Node.js applications evaluating arbitrary or untrusted user-supplied JSONata query expressions\n- **jsonata**: < 1.8.8 (Fixed in: `1.8.8`)\n- **jsonata**: >= 2.0.0 < 2.2.1 (Fixed in: `2.2.1`)\n\n## Mitigation\n\n- Upgrade JSONata library dependency to secure releases.\n- Isolate expression evaluation inside low-privilege sandboxes (e.g., gVisor, Firecracker).\n- Sanitize or reject expressions that contain dynamic property shadow mappings.\n\n**Remediation Steps:**\n1. Identify all uses of the jsonata package in package.json and lockfiles.\n2. For JSONata 1.x, update the package dependency to version 1.8.8.\n3. For JSONata 2.x, update the package dependency to version 2.2.1.\n4. Run npm install or yarn install to apply the updates.\n5. Verify deployment using automated security scans or unit tests simulating the prototype traversal payload.\n\n## References\n\n- [JSONata Security Advisory GHSA-2943-5xfg-gq5f](https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f)\n- [JSONata Pull Request #799 - Mitigate Prototype Pollution and Sandbox Traversal](https://github.com/jsonata-js/jsonata/pull/799)\n- [JSONata Fix Commit 59e2514](https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2)\n- [JSONata Release Commit v2.2.1](https://github.com/jsonata-js/jsonata/commit/06fc08cacff16315edddec9632e98c8c7342785b)\n- [JSONata Release Announcement v1.8.8](https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8)\n- [JSONata Release Announcement v2.2.1](https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77414) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T21:32:06.152219Z"} 2026-08-21T21:32:06.152219+00:00