CVE-2024-27307

🗓️ 06 Mar 2024 19:24:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 390 Views

JSONata JSON query and transformation language vulnerability allows remote code execution or denial of service CVE-2024-2730

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container instances that run or edit flows containing JSONata mapping are vulnerable to arbitrary code execution due to [CVE-2024-27307]	2 Apr 202410:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.5 addresses the security vulnerabilities listed in the CVEs below.	19 Apr 202420:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonata-js JSONata	26 Feb 202518:40	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.13 addresses multiple security vulnerabilities.	31 Jul 202411:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service and remote attack due to node.js jose module and jsonata-js JSONata (CVE-2024-28176, CVE-2024-27307)	16 Apr 202415:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses jsonata-1.8.6 which is vulnerable to CVE-2024-27307, CVE-2022-34169, CVE-2023-20861, CVE-2023-3635, CVE-2018-10237, CVE-2023-33201, CVE-2023-33202, CVE-2023-45288, CVE-2023-20863	28 Jan 202522:08	–	ibm
Chainguard	CVE-2024-27307 vulnerabilities	6 Mar 202420:15	–	cgr
Circl	CVE-2024-27307	6 Mar 202421:26	–	circl
CNNVD	JSONata Security Vulnerabilities	6 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-27307 JSONata expression can pollute the "Object" prototype	6 Mar 202419:24	–	cvelist

NVD

Vulners

Vulnrichment

Node

jsonata jsonataRange1.4.0–1.8.7

jsonata jsonataRange2.0.0–2.0.4

[
  {
    "vendor": "jsonata-js",
    "product": "jsonata",
    "versions": [
      {
        "version": ">= 1.4.0, < 1.8.7",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.0.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c
github	www.github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8
github	www.github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
github	www.github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2
github	www.github.com/jsonata-js/jsonata/releases/tag/v2.0.4

04 Dec 2025 17:55Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.00888

SSVC

CWE-1321