CVE-2026-77413 in jsonata
Summary
by MITRE • 08/21/2026
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
JSONata serves as a powerful query and transformation language for JSON data, widely adopted in modern application architectures to manipulate complex data structures efficiently. However, prior to version 1.8.8 and the release of version 2.2.0, the library contained a critical security flaw within its core function implementation, specifically affecting the lookup mechanism found in src/functions.js. This vulnerability stems from an improper validation check during property access operations. The code failed to verify whether a requested property belonged directly to the object instance or was inherited through the prototype chain using Object.prototype.hasOwnProperty checks. In JavaScript environments where objects inherit properties from their prototypes by default, this oversight allows attackers to bypass intended scoping restrictions and interact with methods and attributes that were not meant to be accessible via standard query expressions.
The technical nature of this flaw constitutes a Prototype Pollution vulnerability which escalates into Remote Code Execution due to the specific capabilities exposed through JavaScript's dynamic property resolution. By supplying crafted JSONata expressions, an attacker can traverse the prototype chain to access inherited members such as setters and getters, constructor references, and valueOf methods. These standard object properties provide pathways to reach sensitive internal modules within the Node.js runtime environment. Specifically, the vulnerability allows exploitation of process.getBuiltinModule, a function that grants direct access to core Node.js modules without requiring explicit require statements or module resolution logic. This capability effectively neutralizes several security boundaries designed to isolate application code from system-level operations.
The operational impact of this vulnerability is severe, as it enables arbitrary command execution with the privileges of the host process running the JSONata engine. If an attacker can control the input expression passed to JSONata, they can construct a payload that leverages the inherited prototype access to instantiate child_process modules and execute system commands. This represents a complete compromise of application integrity and confidentiality. The attack vector is particularly dangerous in scenarios where user-supplied data or untrusted configurations are processed through JSONata transformations, such as in API endpoints, configuration parsers, or template engines. Successful exploitation allows the attacker to read sensitive files, install malware, pivot within the network, or disrupt service availability depending on the permissions granted to the hosting process.
This vulnerability aligns with CWE-915, which describes Improper Modification of Objects During Prototyping, and maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript or Node.js execution. The lack of strict prototype isolation is a common pitfall in dynamic languages but becomes critical when the language engine has access to system-level APIs like those found in Node.js. To mitigate this risk, organizations must immediately upgrade JSONata to version 1.8.8 or later for legacy systems and ensure adoption of version 2.2.0 or newer for current deployments. The fixed versions implement rigorous checks that prevent traversal into inherited prototype properties unless explicitly intended by the language design. Additionally, developers should enforce strict input validation on all expressions passed to JSONata engines and consider running such processes with minimal privileges using principle of least privilege to limit the blast radius in case of future vulnerabilities or misconfigurations.