Skip to main content

JSONata EUVDEUVD-2026-64166

| CVE-2026-77415 CRITICAL
Code Injection (CWE-94)
2026-08-21 GitHub_M GHSA-66mm-25pp-rfff
Code Injection RCE Jsonata
9.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Attacker-controlled expression input reaches host command execution with no auth or interaction; scope unchanged as code runs within the Node process's own authority, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 21, 2026 - 22:02 EUVD
Source Code Evidence Fetched
Aug 21, 2026 - 21:32 vuln.today
Analysis Generated
Aug 21, 2026 - 21:32 vuln.today
CVE Published
Aug 21, 2026 - 21:01 cve.org
CRITICAL 9.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on jsonata (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.

AnalysisAI

Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted JSONata expression to app
Delivery
Overwrite $clone and deconstruct lambdas via $merge.*
Exploit
Forge lambda state, abuse proc.arguments.forEach
Execution
Reach prototype getters and constructor access
Persist
Call process.getBuiltinModule child_process
Impact
Execute OS commands as host process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application evaluate an attacker-supplied or attacker-influenced JSONata expression string on a vulnerable version (jsonata >=2.0.0 <2.2.1, or <1.8.8) running under Node.js where the child_process built-in module is reachable from the process. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects full confidentiality, integrity, and availability loss with no privileges or user interaction, and a fully weaponized PoC in the advisory confirms the chain is practical rather than theoretical - publicly available exploit code exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An application exposes a feature letting users define JSONata expressions to transform incoming JSON (for example an integration rule builder or API query field). An attacker submits the published PoC expression, which overwrites $clone, forges internal lambda state, and pivots through prototype and constructor access to process.getBuiltinModule('child_process').execSync('sh'), running shell commands as the Node.js service account. …
Remediation Upgrade to the exact fixed versions: jsonata 2.2.1 for 2.x users and jsonata 1.8.8 for 1.x users (vendor-released patches confirmed via the v2.2.1 and v1.8.8 release tags and PRs #799, #800, and #802, which replace plain object literals with Object.create(null) and use Array.prototype.forEach.call to remove the mutable-object and lambda-forgery primitives). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all applications and infrastructure using jsonata npm package versions before 1.8.8 or 2.2.1, identify where JSONata expressions are accepted from external or untrusted sources, and document findings. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jsonata

View all
CVE-2026-77413 CRITICAL POC
9.3 Aug 21

Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls
CVE-2026-77414 CRITICAL POC
9.3 Aug 21

Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls

CVE-2024-27307 CRITICAL
9.8 Mar 06

JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2026-12208 MEDIUM POC
5.5 Jun 15

Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-64166 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy