Object Integrity Vulnerability in JSONata from JSONata-js
CVE-2026-77415

9.3CRITICAL

Key Information:

Vendor

Jsonata-js

Status
Jsonata
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77415?

An object integrity vulnerability in JSONata allows crafted expressions to exploit weak security measures, enabling attackers to execute arbitrary code within the context of the host process. By chaining multiple weaknesses, an attacker can compromise the integrity of objects, manipulate internal states, and gain unauthorized access to sensitive functionalities. This vulnerability was addressed in versions 1.8.8 and 2.2.1, which implement necessary fixes to mitigate these risks.

Affected Version(s)

jsonata < 1.8.8 < 1.8.8

jsonata >= 2.0.0, < 2.2.1 < 2.0.0, 2.2.1

References

https://github.com/jsonata-js/jsonata/security/advisories...
x_refsource_CONFIRM
https://github.com/jsonata-js/jsonata/pull/799
x_refsource_MISC
https://github.com/jsonata-js/jsonata/pull/800
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.