JSONata CVE-2026-77414

Exploitation requires that the target application evaluate a JSONata expression that the attacker can control or influence (e.g., jsonata(userInput).evaluate(...)), running on a JavaScript engine with access to process.getBuiltinModule/child_process - i.e., a Node.js host, not a locked-down browser sandbox lacking those built-ins. No authentication is required at the JSONata layer itself (CVSS PR:N), and no special JSONata configuration flag must be enabled - the vulnerable lookup path exists in default behavior of affected versions (< 1.8.8 and 2.0.0-2.2.0). The principal limiting factor is architectural: if the application only ever runs static, developer-authored expressions with no attacker input reaching the expression string, the vulnerability is not remotely reachable. Platform limiter: the child_process RCE payload depends on a Node.js/server-side runtime; environments without those built-in modules cannot reach the demonstrated command-execution impact.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case, wherever the affected application evaluates JSONata expressions that originate even partly from untrusted input. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) reflects full confidentiality, integrity, and availability compromise of the host process, and a concrete published PoC demonstrates reliable exploitation with low complexity, so the practical barrier is low once expression input is reachable. The decisive real-world variable is architectural rather than technical: risk is critical for services that let users supply or influence JSONata expressions (multi-tenant transformation/integration platforms, low-code rule engines, API gateways), and negligible for deployments that only ever run static, developer-authored expressions. EPSS was not provided and there is no CISA KEV entry, so there is currently no evidence of mass active exploitation; because a public exploit exists, any operator that exposes attacker-controllable expressions should treat patching as urgent regardless of the missing EPSS signal, while operators using only trusted static expressions can schedule the upgrade with normal change management.

An application exposes a feature letting users define JSONata expressions to transform JSON (for example a mapping rule, webhook filter, or report template). An attacker submits a crafted expression that reassigns $hasOwnProperty and $constructor to climb the prototype chain and calls process.getBuiltinModule('child_process').execSync('sh'), running arbitrary commands as the service user; a public PoC in the vendor advisory makes this straightforward to reproduce given AV:N/AC:L.