EUVD-2026-64166
GHSA-66mm-25pp-rfff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted JSONata expression to app
-
DeliveryOverwrite $clone and deconstruct lambdas via $merge.*
-
ExploitForge lambda state, abuse proc.arguments.forEach
-
ExecutionReach prototype getters and constructor access
-
PersistCall process.getBuiltinModule child_process
-
ImpactExecute OS commands as host process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application evaluate an attacker-supplied or attacker-influenced JSONata expression string on a vulnerable version (jsonata >=2.0.0 <2.2.1, or <1.8.8) running under Node.js where the child_process built-in module is reachable from the process. The concrete trigger is passing untrusted input into the jsonata() expression compiler/evaluator rather than into the JSON data being queried. What LIMITS exploitation: if the application only runs fixed, developer-authored expressions over untrusted data, an external attacker cannot inject the malicious expression; browser-only deployments without Node's process/child_process, or sandboxed evaluators without child_process access, materially reduce impact. No special JSONata configuration flag is needed - the weakness is in default expression evaluation - so the sole gating factor is whether expression strings cross a trust boundary. |
| Impact | The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects full confidentiality, integrity, and availability loss with no privileges or user interaction, and a fully weaponized PoC in the advisory confirms the chain is practical rather than theoretical - publicly available exploit code exists. The dominant real-world caveat, not captured by the raw vector, is the trust boundary: exploitation requires the application to evaluate an attacker-supplied or attacker-influenced JSONata expression. Deployments that only run fixed, developer-authored expressions over untrusted DATA are largely unaffected, while services that let users submit expression strings (rule builders, low-code/integration platforms, API query parameters) are directly at risk. No EPSS score and no KEV listing are provided, so there is no evidence of at-scale exploitation yet; treat this as high-priority patching for any product that exposes JSONata expression input, and lower urgency where expressions are static and trusted. |
| Exploit ScenarioDerived | An application exposes a feature letting users define JSONata expressions to transform incoming JSON (for example an integration rule builder or API query field). An attacker submits the published PoC expression, which overwrites $clone, forges internal lambda state, and pivots through prototype and constructor access to process.getBuiltinModule('child_process').execSync('sh'), running shell commands as the Node.js service account. A full working PoC is available in the GitHub advisory, and with AV:N/AC:L/PR:N/UI:N the attack needs no authentication or user interaction once expression input is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
RemediationAI
Upgrade to the exact fixed versions: jsonata 2.2.1 for 2.x users and jsonata 1.8.8 for 1.x users (vendor-released patches confirmed via the v2.2.1 and v1.8.8 release tags and PRs #799, #800, and #802, which replace plain object literals with Object.create(null) and use Array.prototype.forEach.call to remove the mutable-object and lambda-forgery primitives). If immediate upgrade is not possible, the strongest compensating control is to stop evaluating untrusted expressions: do not pass attacker-controlled strings into jsonata(); restrict expression authoring to trusted operators, or move JSONata evaluation into an isolated, least-privilege sandbox (separate process, container, or worker with no child_process access and a hardened environment) so that a successful escape cannot reach OS commands - noting this adds operational complexity and does not eliminate confidentiality/integrity impact within the sandbox. Validate and allowlist expression syntax where feasible. Advisory and patch references: GHSA-66mm-25pp-rfff, https://github.com/jsonata-js/jsonata/pull/799, https://github.com/jsonata-js/jsonata/pull/800, https://github.com/jsonata-js/jsonata/pull/802.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JSONata is a widely used declarative query and transformation language for JSON, distributed as the npm package 'jsonata' and embedded in many Node.js services to filter, reshape, and compute over JSON documents. This is a CWE-94 code-injection flaw rooted in the interpreter trusting attacker-influenceable object state: internal bookkeeping objects and function/lambda representations were plain JavaScript objects reachable and mutable from within the expression language. The chain overwrites the user-visible $clone (used by evaluateTransformExpression), destructures JSONata lambdas through $merge.*, and exploits applyProcedure calling proc.arguments.forEach rather than Array.prototype.forEach. These primitives forge internal lambda state and pivot into prototype getters, constructor access, and ultimately process.getBuiltinModule('child_process').execSync, escaping the interpreter into the host runtime.
Know when Jsonata gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attacker-controlled expression input reaches host command execution with no auth or interaction; scope unchanged as code runs within the Node process's own authority, so C/I/A all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Blast Radius
ecosystem impact- 1 npm packages depend on jsonata (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Organizations using the JSONata data transformation library face immediate critical risk of complete system compromise through a remote code execution vulnerability (CVSS 9.3). Any application processing untrusted JSONata expressions-commonly found in API gateways, data pipelines, and business logic processing-can be exploited to execute arbitrary commands with full process privileges. With publicly available exploit code circulating, this represents an urgent threat to data security and operational continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: disable JSONata functionality where operationally feasible; implement strict input validation and whitelists of approved expressions; run Node.js processes with least-privilege credentials in containerized isolation; deploy monitoring for suspicious process execution and network anomalies; evaluate alternative data transformation libraries without expression evaluation capabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls
JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary
Exploit-DB