Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-77413: JSONata library can execute arbitrary code via crafted expression
CVE-2026-77413 · published 13 days ago
Summary
Versions of the JSONata library older than 2.2.0 and 1.8.8 allow specially formed expressions to run any code on the server. An attacker who can supply a JSONata expression could execute commands, potentially taking control of the system. Update to JSONata 2.2.0 or 1.8.8 (or later) to close the gap.
What to do
- Update GitHub Actions jsonata to version 1.8.8.
- Update GitHub Actions jsonata to version 2.2.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | jsonata |
<= 1.8.7 >= 2.0.0, < 2.2.0 < 1.8.8 Fix: upgrade to 1.8.8
|
| – | jsonata-js | jsonata | < 2.2.0 |
Original advisory text
JSONata: Arbitrary Code Execution via crafted JSONata expressions
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
References
- https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4...
- https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca6888...
- https://github.com/jsonata-js/jsonata/pull/794
- https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8
- https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp
- https://github.com/advisories/GHSA-8gq3-vp5j-2grp
- https://github.com/jsonata-js/jsonata Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77413... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77413 Vendor Advisory
Severity
9.9
Critical
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published21 Aug 2026
Updated3 Sep 2026
First seen21 Aug 2026
Sources
CVE-2026-77413 · NVD
GHSA-8gq3-vp5j-2grp · GHSA
GHSA-8gq3-vp5j-2grp · OSV
CVE-2026-77413 · OSV
CVE-2026-77413 · MITRE
Monitor software like this
Free during beta