Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

jsonata-js can run arbitrary code

CVE-2026-77415 · published 2 months ago
Summary

Versions of jsonata-js before 1.8.8 and 2.2.1 let a specially crafted expression execute any code on the server. This could let an attacker take control of the application that uses the library. Upgrade to version 1.8.8 or later (or 2.2.1 or later) to close the risk.

What to do
  • Update GitHub Actions jsonata to version 2.2.1.
  • Update GitHub Actions jsonata to version 1.8.8.
Affected software
Ecosystem VendorProductAffected versions
– jsonata-js jsonata < 1.8.8
npm GitHub Actions jsonata >= 2.0.0, < 2.2.1
< 1.8.8
Fix: upgrade to 2.2.1
Original advisory text
JSONata: Arbitrary Code Execution via crafted JSONata expressions
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published21 Aug 2026
Updated3 Nov 2026
First seen21 Aug 2026
Sources
CVE-2026-77415 · NVD
CVE-2026-77415 · MITRE
GHSA-66mm-25pp-rfff · GHSA
GHSA-66mm-25pp-rfff · OSV
CVE-2026-77415 · OSV
Track software like this
Free during beta