Description
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Published: 2026-08-21
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Code Execution
Action: Immediate Patch
AI Analysis

Impact

JSONata is a JSON query and transformation language that, prior to version 1.8.8 and 2.2.1, allowed crafted expressions to chain a series of object‑integrity weaknesses. By overwriting the internal $clone function, exposing and deconstructing API functions such as $merge.*, and manipulating internal lambda state, an attacker could reach prototype getters, constructor access, and even the built‑in child_process module. This chain of bugs enabled the execution of arbitrary code with the privileges of the host process.

Affected Systems

The vulnerability affects the jsonata-js:jsonata library in any installation using a version earlier than 1.8.8 or 2.2.1. Updated releases starting with 1.8.8 and 2.2.1 contain the fix.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity, and no fixed exploit probability (EPSS) is currently published. The issue is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker supplying a malicious JSONata expression to an application that evaluates expressions without proper validation, thereby executing arbitrary code on the host system.

Generated by OpenCVE AI on August 21, 2026 at 22:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade jsonata-js to version 1.8.8 or newer, or to any 2.2.1 release or later.
  • If an upgrade is not immediately feasible, remove or disable the use of untrusted evaluateTransformExpression calls in the application, or enforce strict validation/whitelisting of expressions before evaluation.
  • Review the application code for any usage of $merge.*, $clone, or related primitives and replace them with safer alternatives or remove them entirely.
  • Implement monitoring for unusual child_process activity or unexpected script execution that may indicate exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-66mm-25pp-rfff JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Jsonata-js
Jsonata-js jsonata
Vendors & Products Jsonata-js
Jsonata-js jsonata

Fri, 21 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Title JSONata: Arbitrary Code Execution via crafted JSONata expressions
Weaknesses CWE-94
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jsonata-js Jsonata
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T16:55:27.467Z

Reserved: 2026-08-20T19:55:27.024Z

Link: CVE-2026-77415

cve-icon Vulnrichment

Updated: 2026-08-25T16:54:46.401Z

cve-icon NVD

Status : Deferred

Published: 2026-08-21T21:17:07.553

Modified: 2026-09-09T21:06:39.057

Link: CVE-2026-77415

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T22:45:04Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')