CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e
https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d
https://github.com/jsonata-js/jsonata/pull/794
https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8
https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0
https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp
https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) JSONata es un lenguaje de consulta y transformación de JSON. Antes de las versiones 1.8.8 y 2.2.0, la función lookup en src/functions.js carecía de una comprobación Object.prototype.hasOwnProperty y permitía que expresiones manipuladas accedieran a miembros de prototipo heredados. Un atacante capaz de proporcionar una expresión podría usar setters y getters de prototipo heredados, acceso al constructor, valueOf y process.getBuiltinModule para alcanzar el módulo child_process y ejecutar código arbitrario con los privilegios del proceso anfitrión. Este problema está solucionado en las versiones 1.8.8 y 2.2.0.

Information

Published : 2026-08-21 21:17

Updated : 2026-10-12 16:10

NVD link : CVE-2026-77413

Mitre link : CVE-2026-77413

CVE.ORG link : CVE-2026-77413

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-77413", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77413", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T19:42:13.845372Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jsonata-js", "product": "jsonata", "versions": [{"status": "affected", "version": "< 2.2.0"}]}]}], "published": "2026-08-21T21:17:07.267", "references": [{"url": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/pull/794", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "source": "security-advisories@github.com"}, {"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0."}, {"lang": "es", "value": "JSONata es un lenguaje de consulta y transformaci\u00f3n de JSON. Antes de las versiones 1.8.8 y 2.2.0, la funci\u00f3n lookup en src/functions.js carec\u00eda de una comprobaci\u00f3n Object.prototype.hasOwnProperty y permit\u00eda que expresiones manipuladas accedieran a miembros de prototipo heredados. Un atacante capaz de proporcionar una expresi\u00f3n podr\u00eda usar setters y getters de prototipo heredados, acceso al constructor, valueOf y process.getBuiltinModule para alcanzar el m\u00f3dulo child_process y ejecutar c\u00f3digo arbitrario con los privilegios del proceso anfitri\u00f3n. Este problema est\u00e1 solucionado en las versiones 1.8.8 y 2.2.0."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}