Jsonata
Monthly
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.
Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary properties into JavaScript's Object.prototype via the createFrame function in src/jsonata.js. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with exploitation status E:P confirms this is network-exploitable with zero prerequisites, and a public proof-of-concept has been published on GitHub demonstrating a hasOwnProperty guard bypass. No patch exists - the vendor failed to respond to coordinated disclosure - leaving all users of jsonata ≤ 2.2.0 indefinitely exposed.
JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.
Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary properties into JavaScript's Object.prototype via the createFrame function in src/jsonata.js. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with exploitation status E:P confirms this is network-exploitable with zero prerequisites, and a public proof-of-concept has been published on GitHub demonstrating a hasOwnProperty guard bypass. No patch exists - the vendor failed to respond to coordinated disclosure - leaving all users of jsonata ≤ 2.2.0 indefinitely exposed.
JSONata is a JSON query and transformation language. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.