Vulnerability in JSONata library affecting versions prior to 1.8.8 and 2.2.0

CVE-2026-77413

What is CVE-2026-77413?

A vulnerability in the JSONata library allows attackers to exploit a flaw in the lookup function found in src/functions.js. This oversight prevents proper checks against Object.prototype.hasOwnProperty, enabling crafted expressions to access properties of the prototype chain. By supplying specially formed expressions, an attacker can manipulate inherited prototype setters and getters, as well as constructor functions. This can lead to unauthorized access to sensitive modules, including the child_process module, allowing for the execution of arbitrary code within the privileges of the host process. Users are encouraged to upgrade to versions 1.8.8 or 2.2.0 or later to mitigate this risk.

References