JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.jsL1863-L1871 This was fixed in...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77414 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77414 Source advisory: OSV:GHSA-2943-5XFG-GQ5F...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: SNYK:JS-JSONATA-19233336...

GHSA-2943-5XFG-GQ5F JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.jsL1863-L1871 This was fixed in...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: OSV:GHSA-2943-5XFG-GQ5F...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77414 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77414 Source advisory: SNYK:JS-JSONATA-19233336...

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions = 1.8.7...

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77413 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77413 Source advisory: OSV:GHSA-8GQ3-VP5J-2GRP...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77413 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77413 Source advisory: SNYK:JS-JSONATA-19233338...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77413 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77413 Source advisory: SNYK:JS-JSONATA-19233338...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77413 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77413 Source advisory: OSV:GHSA-8GQ3-VP5J-2GRP...

GHSA-8GQ3-VP5J-2GRP JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...

CVE-2026-77414

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution in versions prior to 1.8.8 and 2.2.1 . The root cause is a bypassable hasOwnProperty check in the environment.lookup function of src/jsonata.js. An attacker can craft expressions chaining $hasOwnProperty,...

CVE-2026-77414 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

EUVD-2026-64083

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

CVE-2026-77414 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

EUVD-2026-64155

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-77413

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution prior to versions 1.8.8 and 2.2.0 . The root cause is a missing Object.prototype.hasOwnProperty check in the src/functions.js lookup function, which allows crafted expressions to access inherited prototyp...