Skip to main content

JSONata CVE-2026-77413

| EUVDEUVD-2026-64155 CRITICAL
Code Injection (CWE-94)
2026-08-21 GitHub_M GHSA-8gq3-vp5j-2grp
Code Injection RCE Jsonata
9.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Attacker who supplies an expression (PR:N in exposed apps) achieves RCE with low complexity and full C/I/A on the host process; scope unchanged as code runs as the same process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 21, 2026 - 21:17 vuln.today
Analysis Generated
Aug 21, 2026 - 21:17 vuln.today
Patch available
Aug 21, 2026 - 21:02 EUVD
CVE Published
Aug 21, 2026 - 20:47 cve.org
CRITICAL 9.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on jsonata (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.

AnalysisAI

Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted JSONata expression
Delivery
lookup resolves inherited prototype members
Exploit
Reach constructor and process.getBuiltinModule
Execution
Invoke child_process.execSync
Impact
Execute OS commands as host process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application evaluate an attacker-controlled JSONata expression string via jsonata(...).evaluate() on a vulnerable version (<= 1.8.7 or 2.0.0-2.1.x) running under Node.js with process.getBuiltinModule/child_process available. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) reflects the worst case: full compromise with no privileges or interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An application lets users submit JSONata expressions to transform their JSON (a common iPaaS/rules-engine pattern) and evaluates them with a vulnerable jsonata version. An attacker submits the advisory PoC expression using __lookupSetter__/__defineGetter__ and constructor to reach process.getBuiltinModule('child_process').execSync('sh'), gaining command execution as the Node service account. …
Remediation Vendor-released patch: upgrade to jsonata 2.2.0 (2.x line) or 1.8.8 (1.x backport). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Conduct immediate inventory of all internal applications using JSONata npm package; prioritize those processing user-supplied or external data as JSONata expressions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jsonata

View all
CVE-2026-77415 CRITICAL POC
9.3 Aug 21

Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who c
CVE-2026-77414 CRITICAL POC
9.3 Aug 21

Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls

CVE-2024-27307 CRITICAL
9.8 Mar 06

JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2026-12208 MEDIUM POC
5.5 Jun 15

Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-77413 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy