JSONata CVE-2026-77413

Exploitation requires that the target application evaluate an attacker-controlled JSONata expression string via jsonata(...).evaluate() on a vulnerable version (<= 1.8.7 or 2.0.0-2.1.x) running under Node.js with process.getBuiltinModule/child_process available. The exact trigger is a crafted expression chaining inherited prototype members (__lookupSetter__('__proto__'), __defineGetter__, constructor, valueOf) to reach child_process - as shown in the advisory PoC. What limits exploitation: the attacker must control the expression itself (not merely the JSON data being queried), so deployments that use only static, developer-authored expressions are not remotely exploitable by outside users; it also requires a Node.js runtime (not a hardened/sandboxed JS environment lacking process/child_process) and a pre-2.2.0/1.8.8 version.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) reflects the worst case: full compromise with no privileges or interaction. The decisive real-world variable, however, is whether the deploying application feeds attacker-controlled input into jsonata() as an expression. JSONata expressions are usually authored by developers and treated as trusted code; the CVSS PR:N/AV:N rating implicitly assumes the application exposes expression authoring to untrusted users (e.g., user-defined transforms, rules, or mappings). Where expressions are static and developer-supplied, practical exploitability drops sharply toward local/authenticated. No EPSS score, KEV listing, or SSVC decision data was provided; there is no indication of active exploitation, so this is not confirmed in-the-wild. A working PoC in the advisory raises the likelihood of opportunistic use against apps that do accept user expressions. Net: treat as a high-priority patch for any product that evaluates user-supplied JSONata, and as lower urgency where expressions are fixed and trusted - verify your usage model before ranking.

An application lets users submit JSONata expressions to transform their JSON (a common iPaaS/rules-engine pattern) and evaluates them with a vulnerable jsonata version. An attacker submits the advisory PoC expression using __lookupSetter__/__defineGetter__ and constructor to reach process.getBuiltinModule('child_process').execSync('sh'), gaining command execution as the Node service account. A public PoC exists in the GHSA advisory, and with AV:N/AC:L this requires only the ability to supply the expression string.