Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

JSONata library can execute arbitrary code via crafted expression

CVE-2026-77413 · published 2 months ago
Summary

Versions of the JSONata library older than 2.2.0 and 1.8.8 allow specially formed expressions to run any code on the server. An attacker who can supply a JSONata expression could execute commands, potentially taking control of the system. Update to JSONata 2.2.0 or 1.8.8 (or later) to close the gap.

What to do
  • Update GitHub Actions jsonata to version 1.8.8.
  • Update GitHub Actions jsonata to version 2.2.0.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions jsonata <= 1.8.7
>= 2.0.0, < 2.2.0
< 1.8.8
Fix: upgrade to 1.8.8
– jsonata-js jsonata < 2.2.0
Original advisory text
JSONata: Arbitrary Code Execution via crafted JSONata expressions
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published21 Aug 2026
Updated4 Nov 2026
First seen21 Aug 2026
Sources
CVE-2026-77413 · NVD
GHSA-8gq3-vp5j-2grp · GHSA
GHSA-8gq3-vp5j-2grp · OSV
CVE-2026-77413 · OSV
CVE-2026-77413 · MITRE
Track software like this
Free during beta