Arbitrary Code Execution Vulnerability in JSONata by JSONata
CVE-2026-77414
9.3CRITICAL
What is CVE-2026-77414?
The JSONata query and transformation language contains a vulnerability in the src/jsonata.js environment.lookup function, which utilized a bypassable hasOwnProperty check. This flaw could allow attackers to leverage crafted expressions involving $hasOwnProperty, $spread, $string, prototype access, and $constructor to target the object prototype. Consequently, this could lead to the invocation of process.getBuiltinModule via child_process, enabling the execution of arbitrary code with the privileges of the host process. The issue was addressed in versions 1.8.8 and 2.2.1, which mitigated the risk by introducing necessary checks.
Affected Version(s)
jsonata < 1.8.8 < 1.8.8
jsonata >= 2.0.0, < 2.2.1 < 2.0.0, 2.2.1