JSONata is a JSON query and transformation language that allows data to be queried and restructured. In versions older than 1.8.8 and 2.2.1, the environment.lookup function contained a bypassable hasOwnProperty check. Attackers can craft expressions that use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, thereby executing arbitrary code with the privileges of the host process. This flaw enables complete compromise of the application or environment in which the library runs.

The vulnerability affects the jsonata-js jsonata library. Any deployment using the library prior to version 1.8.8 or version 2.2.1 is susceptible. No specific operating systems or languages are excluded; the issue exists wherever the vulnerable library is loaded and used to evaluate untrusted JSONata expressions.

The CVSS score of 9.3 classifies the flaw as high severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote: an attacker who can supply or influence a JSONata expression that the application evaluates will be able to trigger arbitrary code execution. Because the code runs with the host process's permissions, the impact could be complete system takeover or data exfiltration.