jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

高 7.5CVE-2026-52746 · GHSA-86vw-mfpg-wwv9 · 17/07/2026 公開 · 24/10/2026 更新

要点

CVE-2026-52746 は jsonata (jsonata), jsonata に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 52.8% より高い）。
対処：2.2.0, 1.8.9 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
jsonata jsonata	`< 2.2.0`	`2.2.0`
jsonata npm	`≥ 2.0.0, < 2.2.0< 1.8.9`	`2.2.01.8.9`

概要

Impact

Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

Patches

This issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.

References

https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0 https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9

Credit

Thank you to Doruk Tan Öztürk for disclosing this issue.

NVD の説明

JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.