{"id":"EUVD-2026-64083","enisaUuid":"82adc52a-c4f5-3b52-b400-326ccab5b8fa","description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","datePublished":"Aug 21, 2026, 8:51:43 PM","dateUpdated":"Aug 26, 2026, 5:42:09 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","aliases":"CVE-2026-77414\nGHSA-2943-5xfg-gq5f\n","assigner":"GitHub_M","epss":0.57,"enisaIdProduct":[{"id":"1eb297d6-e625-359a-946c-9e7d4050f7f3","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"2.0.0, \u003c 2.2.1"},{"id":"b03e1df4-3b54-3d45-92d6-02bd48685440","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"\u003c 1.8.8"}],"enisaIdVendor":[{"id":"3e423efc-41c5-3d37-b229-e68123b39c6b","vendor":{"name":"jsonata-js"}}],"enisaIdVulnerability":[{"id":"594e0ce0-60bb-35dd-81a7-1f50c7205771","vulnerability":{"id":"GHSA-2943-5xfg-gq5f","description":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","datePublished":"Aug 21, 2026, 8:58:01 PM","dateUpdated":"Aug 21, 2026, 8:58:01 PM","baseScore":0.0,"references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/commit/c41ef185136a7b96ca1049c7745a7503b82193de\nhttps://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159\nhttps://github.com/jsonata-js/jsonata\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","enisa_id":"EUVD-2026-64083\n","aliases":"CVE-2026-77414\nGHSA-2943-5xfg-gq5f\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9167c6e2-bb90-3ef4-901e-594ba0c06752","vulnerability":{"id":"CVE-2026-77414","description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","datePublished":"Aug 21, 2026, 8:51:43 PM","dateUpdated":"Aug 26, 2026, 5:42:09 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","enisa_id":"EUVD-2026-64083\n","assigner":"GitHub_M","epss":0.57,"dataProcessed":"Nov 7, 2026, 7:19:31 AM","vulnerabilityProduct":[{"id":"291a9382-b83a-3600-acd6-bba5f1ed1736","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"\u003c 1.8.8"},{"id":"d2ba8c3c-1236-3572-ab69-cfca066e0e4c","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"2.0.0, \u003c 2.2.1"}],"vulnerabilityVendor":[{"id":"b80111dd-10f1-37b0-8114-dea8f3d6eb32","vendor":{"name":"jsonata-js"}}]}}],"enisaIdAdvisory":[{"id":"99416266-9ff1-3c85-bb3e-50753766c205","advisory":{"id":"RHSA-2026:76788","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","summary":"Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","datePublished":"Oct 6, 2026, 1:09:32 PM","dateUpdated":"Nov 4, 2026, 3:48:29 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76788\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76788.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-77413\nCVE-2026-77414\nCVE-2026-77415\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"180d3269-d15f-343c-82e8-83cb197e3acc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:5549940696691cc087777c20f5d46b485d31e9fe3db896caa2eca7bfef3edb72_amd64","vendor":{"name":"Red Hat"}}},{"id":"49d020b5-3790-3915-8a55-d6e6d709f5f8","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"57ffb8cd-cfbe-3f7e-9c00-85aee590bf45","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:c6a5e6d9c8f3ab900c2b29848273540f4a3e97d351faa338a66da46c0b59d04f_amd64","vendor":{"name":"Red Hat"}}},{"id":"9fc9309a-ed78-376e-9e98-7d17f6b24ec7","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3aa39a8c3b7bf33aeaae5b3f924d0a2f7625e64657ce9b5517a3a73620f142bb_amd64","vendor":{"name":"Red Hat"}}},{"id":"b7170e41-a20c-34cb-af94-29802c6e7b5f","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:55b8b4e43f9dd474dee53d824591695012994daec86efee4dc08612b12425a46_amd64","vendor":{"name":"Red Hat"}}},{"id":"c0c3bef5-d9ee-3d1c-ae0d-0baec98a55b0","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:924c4e5e8642438f3099272ff7edd746a66fcec4779aeafb9fd6b3ae0c594f72_amd64","vendor":{"name":"Red Hat"}}},{"id":"e4e2cfac-97a6-3481-8285-5dfb16156229","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:df55fd567640bcd54d8e0d19baa97a5e72429865ad342c94bb80c3a49a5c184e_amd64","vendor":{"name":"Red Hat"}}},{"id":"feec8110-5ed4-3c49-8e16-23feb910d9bc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:0ca07bd2b15a85bfda16cbc0904fb4ee6c8620e18b891ba89ae792cf0a165095_amd64","vendor":{"name":"Red Hat"}}}]}}]}