What is the CVSS score of CVE-2026-52746?

CVE-2026-52746 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

How to fix or mitigate CVE-2026-52746?

Within 24 hours: Audit production inventory for jsonata dependencies and identify systems that evaluate user-controlled JSONata expressions or process untrusted input. Within 7 days: Stage and test upgrade to jsonata 2.2.0 or later; prioritize applications that accept customer-facing input. Within 30 days: Complete production deployment of patched version, verify event-loop stability under normal load, and establish intake review to flag high-reuse JavaScript libraries in future vendor assessments.

CVE-2026-52746

EUVD-2026-45253 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-02 https://github.com/jsonata-js/jsonata

GHSA-86vw-mfpg-wwv9

Denial Of Service

7.5

CVSS 3.1 · Vendor: https://github.com/jsonata-js/jsonata

Severity by source

Vendor (https://github.com/jsonata-js/jsonata) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (https://github.com/jsonata-js/jsonata).

CVSS VectorVendor: https://github.com/jsonata-js/jsonata

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:36 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on jsonata (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

Impact

In JSONata <v2.2.0, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

Patches

This issue has been addressed in JSONata version >= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.

References

https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0

Credit

Thank you to Doruk Tan Öztürk for disclosing this issue.

AnalysisAI

Denial of service in the JSONata JavaScript query/transformation library (npm 'jsonata') before 2.2.0 allows remote attackers to hang the event loop by supplying crafted, non-matching date strings to the $toMillis function, whose ISO-8601 validation regex is vulnerable to superlinear (catastrophic) backtracking. Any application that evaluates user-provided JSONata expressions or feeds attacker-controlled data into $toMillis is exposed. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but EPSS/exploitation likelihood aside, the CVSS 7.5 (A:H) reflects a clean availability-only impact.