JSONata expression can pollute the "Object" prototype

Impact In JSONata versions = 1.4.0, = 2.0.0, = 1.8.7 and = 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible. patch --- a/src/jsonata.js +++ b/src/jsonata.js @@ -1293,6 +1293,13 @@...

@activepieces/piece-json (0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +10 more potentially affected by CVE-2024-27307 via jsonata (>=2.0.0, <=2.0.3)

jsonata NPM version =2.0.0, =5.0.0, =2.3.132, =1.0.0, =1.0.0, =0.14.0, =5.1.0, =4.0.0, =1.0.7, =1.0.17 - renovate 36.109.4 Source cves: CVE-2024-27307 Source advisory: OSV:GHSA-FQG8-VFV7-8FJ8...

GHSA-FQG8-VFV7-8FJ8 JSONata expression can pollute the "Object" prototype

Impact In JSONata versions = 1.4.0, = 2.0.0, = 1.8.7 and = 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible. patch --- a/src/jsonata.js +++ b/src/jsonata.js @@ -1293,6 +1293,13 @@...

PT-2024-2194

Name of the Vulnerable Software and Affected Versions JSONata versions 1.4.0 through 1.8.6 JSONata versions 2.0.0 through 2.0.3 Description A malicious expression can use the transform operator to override properties on the Object constructor and prototype, potentially leading to denial of servic...