EUVD-2026-64083
GHSA-2943-5xfg-gq5f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable expression evaluation with low complexity and no auth at the JSONata layer (PR:N); full host-process compromise gives C:H/I:H/A:H, S:U as impact stays within the host process authority.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on jsonata (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
DescriptionCVE.org
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
AnalysisAI
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application evaluate a JSONata expression that the attacker can control or influence (e.g., jsonata(userInput).evaluate(...)), running on a JavaScript engine with access to process.getBuiltinModule/child_process - i.e., a Node.js host, not a locked-down browser sandbox lacking those built-ins. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case, wherever the affected application evaluates JSONata expressions that originate even partly from untrusted input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application exposes a feature letting users define JSONata expressions to transform JSON (for example a mapping rule, webhook filter, or report template). An attacker submits a crafted expression that reassigns $hasOwnProperty and $constructor to climb the prototype chain and calls process.getBuiltinModule('child_process').execSync('sh'), running arbitrary commands as the service user; a public PoC in the vendor advisory makes this straightforward to reproduce given AV:N/AC:L. |
| Remediation | Upgrade the jsonata dependency to a fixed release: 2.2.1 for the 2.x line or 1.8.8 for the 1.x line (Vendor-released patch: 1.8.8 and 2.2.1), per https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f, with the code change in https://github.com/jsonata-js/jsonata/pull/799 and commit 59e25144fc3b7125f6befd71b8a6e14e1fa610d2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services using the JSONata npm package through dependency audits and code scans. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who c
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls
JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today