CVE-2026-12208: jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution
A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
jsonata-js jsonatafrom your environment.Uninstall or remove jsonata from applications where it is not required — especially avoid using jsonata versions up to 2.2.0 — to eliminate the vulnerable component.
- Compensating control
Restrict remote access to any services or endpoints that process input via jsonata (vulnerable up to 2.2.0) using network controls (firewall, ACLs, WAF) and isolate or sandbox processing of untrusted data to reduce risk of prototype pollution exploitation.
- Operational
Monitor the jsonata project and vendor advisories for a security patch/fix addressing the createFrame prototype pollution issue and apply the vendor-supplied fix/patch as soon as it is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12208?
The severity of CVE-2026-12208 is medium, with a score of 5.3.
How do I fix CVE-2026-12208?
To fix CVE-2026-12208, update the jsonata-js library to version 2.2.1 or later.
What vulnerabilities does CVE-2026-12208 expose in jsonata-js?
CVE-2026-12208 exposes vulnerabilities related to prototype pollution, allowing unauthorized modification of object prototype attributes.
In which versions of jsonata-js does CVE-2026-12208 exist?
CVE-2026-12208 exists in jsonata-js versions up to and including 2.2.0.
Which function in jsonata.js is affected by CVE-2026-12208?
The createFrame function in the src/jsonata.js file is affected by CVE-2026-12208.