@3c-node-red/runtime (=3.1.6), @adeunis/node-red-contrib-adeunis-codecs (=1.0.0) +244 more potentially affected by CVE-2024-27307 via jsonata (>=1.5.0 <=1.8.6)

jsonata NPM version =1.5.0, =20.2.3, =5.0.0, =0.8.0, =0.0.1, =1.0.0, =1.0.1, =2.0.0, =2.0.4 - @elastic.io/batching-library =2.0.1-dev.4 and more Source cves: CVE-2024-27307 Source advisory: OSV:GHSA-FQG8-VFV7-8FJ8...

@bifravst/muninn-proto (>=5.0.0 <=5.2.0-chart-proto.1), @cenk1cenk2/renovate-config (>=2.3.132 <=2.3.148) +9 more potentially affected by CVE-2024-27307 via jsonata (=2.0.3)

jsonata NPM version =2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on jsonata and may be impacted: - @bifravst/muninn-proto =5.0.0, =2.3.132, =1.0.0, =1.0.0, =0.14.0, =5.1.0, =4.0.0, =1.0.7, =36.7.0, =37.227.0 Source cves: CVE-2024-27307 Source...

JSONata expression can pollute the "Object" prototype

Impact In JSONata versions = 1.4.0, = 2.0.0, = 1.8.7 and = 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible. patch --- a/src/jsonata.js +++ b/src/jsonata.js @@ -1293,6 +1293,13 @@...

GHSA-FQG8-VFV7-8FJ8 JSONata expression can pollute the "Object" prototype

Impact In JSONata versions = 1.4.0, = 2.0.0, = 1.8.7 and = 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible. patch --- a/src/jsonata.js +++ b/src/jsonata.js @@ -1293,6 +1293,13 @@...

PT-2024-2194

Name of the Vulnerable Software and Affected Versions JSONata versions 1.4.0 through 1.8.6 JSONata versions 2.0.0 through 2.0.3 Description A malicious expression can use the transform operator to override properties on the Object constructor and prototype, potentially leading to denial of servic...