jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

CAO 7.5CVE-2026-52746 · GHSA-86vw-mfpg-wwv9 · Công bố 17/07/2026 · cập nhật 24/10/2026

Tóm tắt nhanh

CVE-2026-52746 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng jsonata (jsonata), jsonata.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.69%, cao hơn 52.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.2.0, 1.8.9 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
jsonata jsonata	`< 2.2.0`	`2.2.0`
jsonata npm	`≥ 2.0.0, < 2.2.0< 1.8.9`	`2.2.01.8.9`

Mô tả

Impact

Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

Patches

This issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.

References

https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0 https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9

Credit

Thank you to Doruk Tan Öztürk for disclosing this issue.

Mô tả của NVD

JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.