What is the CVSS score of CVE-2026-52746?

CVE-2026-52746 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How to fix or mitigate CVE-2026-52746?

Within 24 hours: Audit production inventory for jsonata dependencies and identify systems that evaluate user-controlled JSONata expressions or process untrusted input. Within 7 days: Stage and test upgrade to jsonata 2.2.0 or later; prioritize applications that accept customer-facing input. Within 30 days: Complete production deployment of patched version, verify event-loop stability under normal load, and establish intake review to flag high-reuse JavaScript libraries in future vendor assessments.

CVE-2026-52746

HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-02 https://github.com/jsonata-js/jsonata

GHSA-86vw-mfpg-wwv9

Denial Of Service

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:36 vuln.today

DescriptionGitHub Advisory

Impact

In JSONata <v2.2.0, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

Patches

This issue has been addressed in JSONata version >= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.

References

https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0

Credit

Thank you to Doruk Tan Öztürk for disclosing this issue.

AnalysisAI

Denial of service in the JSONata JavaScript query/transformation library (npm 'jsonata') before 2.2.0 allows remote attackers to hang the event loop by supplying crafted, non-matching date strings to the $toMillis function, whose ISO-8601 validation regex is vulnerable to superlinear (catastrophic) backtracking. Any application that evaluates user-provided JSONata expressions or feeds attacker-controlled data into $toMillis is exposed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit production inventory for jsonata dependencies and identify systems that evaluate user-controlled JSONata expressions or process untrusted input. …

Threat intelligence, references, and detailed analysis are available after sign-in.