{"id":"EUVD-2026-64166","enisaUuid":"cebafa7b-be4e-3dc3-b1f7-58981a145655","description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","datePublished":"Aug 21, 2026, 9:01:09 PM","dateUpdated":"Aug 25, 2026, 4:55:27 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/pull/800\nhttps://github.com/jsonata-js/jsonata/pull/802\nhttps://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fcae47d06\nhttps://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159\nhttps://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e814004bc4d\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","aliases":"CVE-2026-77415\nGHSA-66mm-25pp-rfff\n","assigner":"GitHub_M","epss":0.89,"enisaIdProduct":[{"id":"92b1b0d3-1379-3180-8c2c-01755cdb5af6","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"2.0.0, \u003c 2.2.1"},{"id":"d3bf0b59-f8fa-3bfe-bdd7-4d73d8ec8acc","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"\u003c 1.8.8"}],"enisaIdVendor":[{"id":"cab71215-0dcc-3e21-960c-9b7037167db3","vendor":{"name":"jsonata-js"}}],"enisaIdVulnerability":[{"id":"124bfcb0-bf28-39de-bd83-153d5eb2d00e","vulnerability":{"id":"GHSA-66mm-25pp-rfff","description":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","datePublished":"Aug 21, 2026, 9:04:19 PM","dateUpdated":"Aug 21, 2026, 9:04:19 PM","baseScore":0.0,"references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/pull/800\nhttps://github.com/jsonata-js/jsonata/pull/802\nhttps://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fcae47d06\nhttps://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159\nhttps://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e814004bc4d\nhttps://github.com/jsonata-js/jsonata\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","enisa_id":"EUVD-2026-64166\n","aliases":"CVE-2026-77415\nGHSA-66mm-25pp-rfff\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b1599793-7e03-3bd0-ae07-70dfcc057aab","vulnerability":{"id":"CVE-2026-77415","description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","datePublished":"Aug 21, 2026, 9:01:09 PM","dateUpdated":"Aug 25, 2026, 4:55:27 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff\nhttps://github.com/jsonata-js/jsonata/pull/799\nhttps://github.com/jsonata-js/jsonata/pull/800\nhttps://github.com/jsonata-js/jsonata/pull/802\nhttps://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fcae47d06\nhttps://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e\nhttps://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2\nhttps://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159\nhttps://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e814004bc4d\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.8\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.1\n","enisa_id":"EUVD-2026-64166\n","assigner":"GitHub_M","epss":0.89,"dataProcessed":"Nov 1, 2026, 7:16:30 AM","vulnerabilityProduct":[{"id":"69869569-a166-3bc4-85ef-a8064fa45376","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"\u003c 1.8.8"},{"id":"b8be6cdb-4388-3378-a602-5b847a8b8b5f","product":{"name":"jsonata","vendor":{"name":"jsonata-js"}},"product_version":"2.0.0, \u003c 2.2.1"}],"vulnerabilityVendor":[{"id":"08a95f0b-e163-382c-95d7-45ebfa589d1b","vendor":{"name":"jsonata-js"}}]}}],"enisaIdAdvisory":[{"id":"3bca86b9-3f3c-30f1-91a4-71bab5c290ba","advisory":{"id":"RHSA-2026:76788","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","summary":"Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","datePublished":"Oct 6, 2026, 1:09:32 PM","dateUpdated":"Oct 31, 2026, 9:02:39 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76788\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76788.json\n","aliases":"CVE-2026-13697\nCVE-2026-19534\nCVE-2026-47683\nCVE-2026-47686\nCVE-2026-47698\nCVE-2026-55553\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77037\nCVE-2026-77078\nCVE-2026-77413\nCVE-2026-77414\nCVE-2026-77415\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\nCVE-2026-84961\nCVE-2026-87776\nCVE-2026-88932\nCVE-2026-89011\nCVE-2026-92934\nCVE-2026-92935\nCVE-2026-92937\nCVE-2026-92938\nCVE-2026-92939\nCVE-2026-92940\nCVE-2026-92941\nCVE-2026-92942\nCVE-2026-92944\nCVE-2026-92946\nCVE-2026-92947\nCVE-2026-92948\nCVE-2026-92950\nCVE-2026-92951\nCVE-2026-92953\nCVE-2026-92954\nCVE-2026-92955\nCVE-2026-92956\nCVE-2026-92957\nCVE-2026-92958\nCVE-2026-92959\nCVE-2026-92960\nCVE-2026-92961\nCVE-2026-93603\nCVE-2026-93604\nCVE-2026-93605\nCVE-2026-93606\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"180d3269-d15f-343c-82e8-83cb197e3acc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:5549940696691cc087777c20f5d46b485d31e9fe3db896caa2eca7bfef3edb72_amd64","vendor":{"name":"Red Hat"}}},{"id":"49d020b5-3790-3915-8a55-d6e6d709f5f8","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"57ffb8cd-cfbe-3f7e-9c00-85aee590bf45","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:c6a5e6d9c8f3ab900c2b29848273540f4a3e97d351faa338a66da46c0b59d04f_amd64","vendor":{"name":"Red Hat"}}},{"id":"9fc9309a-ed78-376e-9e98-7d17f6b24ec7","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3aa39a8c3b7bf33aeaae5b3f924d0a2f7625e64657ce9b5517a3a73620f142bb_amd64","vendor":{"name":"Red Hat"}}},{"id":"b7170e41-a20c-34cb-af94-29802c6e7b5f","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:55b8b4e43f9dd474dee53d824591695012994daec86efee4dc08612b12425a46_amd64","vendor":{"name":"Red Hat"}}},{"id":"c0c3bef5-d9ee-3d1c-ae0d-0baec98a55b0","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:924c4e5e8642438f3099272ff7edd746a66fcec4779aeafb9fd6b3ae0c594f72_amd64","vendor":{"name":"Red Hat"}}},{"id":"e4e2cfac-97a6-3481-8285-5dfb16156229","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:df55fd567640bcd54d8e0d19baa97a5e72429865ad342c94bb80c3a49a5c184e_amd64","vendor":{"name":"Red Hat"}}},{"id":"feec8110-5ed4-3c49-8e16-23feb910d9bc","product":{"name":"registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:0ca07bd2b15a85bfda16cbc0904fb4ee6c8620e18b891ba89ae792cf0a165095_amd64","vendor":{"name":"Red Hat"}}}]}}]}