CVE-2026-77415

A flaw was found in JSONata, a JSON query and transformation language. A remote attacker could exploit multiple object-integrity weaknesses by crafting malicious JSONata expressions. This could lead to arbitrary code execution with the privileges of the host process, allowing the attacker to take...

CVE-2026-77413

A flaw was found in JSONata. The lookup function, a component of the JSONata query and transformation language, did not properly validate object properties. This oversight allowed an attacker to craft malicious expressions that could access and manipulate sensitive inherited prototype members...

CVE-2026-77414

A flaw was found in JSONata, a JSON query and transformation language. This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the host process. By crafting malicious JSONata expressions, an attacker can bypass a security check, gaining unauthorized access to...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Code Injection due to Node.js module jsonata (CVE-2026-12208)

Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Code Injection due to Node.js module jsonata. Vulnerability Details CVEID:CVE-2026-12208 DESCRIPTION: A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the...

SUSE CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

SUSE CVE-2026-77414

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

SUSE CVE-2026-77415

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct...

The vulnerability of the lookup() function in the child_process module of the json-data transformation software JSONata allows a attacker to execute arbitrary code.

The vulnerability of the lookup function in the childprocess module of the json-data transformation software JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the child_process module in the json-data transformation software JSONata allows a hacker to execute arbitrary code.

The vulnerability of the childprocess module in the json-data transformation software JSONata is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the environment.lookup() function in the child_process module of the json-data processing tool, JSONata, allows a attacker to execute arbitrary code.

The vulnerability of the environment.lookup function in the childprocess module of the json-data processing tool JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to the absence of an Object.prototype.hasOwnProperty check, which allows an attacker to access inherited prototype members and constructors and ultimately execute arbitrary code with the privileges of the host process...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to object-integrity weaknesses that allow crafted JSONata expressions to manipulate internal functions and access prototype and constructor properties, which allows an attacker to execute arbitrary code with the privilege...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to a bypassable hasOwnProperty check that allows crafted expressions to access object prototypes and constructors, which allows an attacker to invoke process.getBuiltinModule with childprocess and execute arbitrary code...

CVE-2026-77415

creationtimestamp| type| source ---|---|--- 2026-08-21 22:08:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmrk2e5qb2u 2026-08-21 22:31:20+00:00| seen| https://gist.github.com/alon710/20a50aebfd35291a76583a04e09e8467 2026-08-21 22:35:03+00:00| published-proof-of-concept|...

CVE-2026-77413

creationtimestamp| type| source ---|---|--- 2026-08-21 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmrjjdpmb2m 2026-08-21 22:35:10+00:00| published-proof-of-concept| https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp 2026-08-22...

CVE-2026-77414

creationtimestamp| type| source ---|---|--- 2026-08-21 21:32:06+00:00| seen| https://gist.github.com/alon710/c3aaed90ea510257bc4b82da4dd81787 2026-08-21 22:08:39+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmrjrjqer2m 2026-08-21 22:35:05+00:00| published-proof-of-concept|...

CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-77414

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

CVE-2026-77415

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct...

Arbitrary Code Injection

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Arbitrary Code Injection via crafted expressions that exploit the evaluateTransformExpression and applyProcedure functions. An attacker can execute arbitrary code by submitting special...