JSONata is a JSON query and transformation language. The vulnerability resides in the lookup function, which fails to verify that accessed properties belong to the target object rather than the prototype chain. A crafted expression can read inherited properties such as setters, getters, constructors, valueOf, and process.getBuiltinModule. This flaw permits an attacker who can supply an arbitrary JSONata expression to reach the child_process module and execute code with the privileges of the host process.

The jsonata-js:jsonata package is affected in all releases prior to 1.8.8 and prior to 2.2.0. Systems utilizing either older 1.x or 2.x series deployments of JSONata are vulnerable.

The CVSS score of 9.3 reflects a catastrophic potential impact. The absence of an EPSS score does not reduce the likelihood of exploitation. Exploitation requires that the application evaluates user-supplied or otherwise externally sourced JSONata expressions. When that condition exists, an attacker can inject a malicious expression to trigger a prototype chain traversal and gain full control of the host process. Until the vendor fix is applied, the risk remains high.