CVE-2026-77414 in JSONata
Summary
by MITRE • 08/22/2026
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
JSONata serves as a powerful query and transformation language for JSON data, widely adopted in modern application stacks to manipulate structured information efficiently. However, prior to version 1.8.8 and the minor release 2.2.1, the implementation contained a critical security flaw within its environment lookup mechanism. The vulnerability stems from an improper check of object properties during the evaluation of expressions. Specifically, the src/jsonata.js file utilized a bypassable hasOwnProperty check that failed to adequately distinguish between own properties and inherited ones in certain contexts involving prototype chains. This oversight allowed attackers to manipulate how objects were resolved within the JSONata execution environment, creating a pathway for unauthorized access to internal object structures.
The technical core of this vulnerability lies in the ability to traverse JavaScript's prototype chain using specific built-in functions exposed by JSONata. By crafting malicious expressions that leverage $hasOwnProperty, $spread, and $string, an attacker can bypass standard isolation boundaries. These constructs enable the manipulation of object prototypes, allowing access to the Object.prototype itself. Once the prototype is accessed, the attacker can utilize $constructor to instantiate new objects or invoke methods on existing ones with elevated privileges relative to the JSONata sandbox. This chain of exploitation ultimately leads to the invocation of process.getBuiltinModule from the Node.js environment, specifically targeting the child_process module.
The operational impact of this vulnerability is severe, as it results in Remote Code Execution (RCE) within the context of the host application. Since JSONata often runs server-side or in environments with access to system resources, successfully exploiting this flaw allows an attacker to execute arbitrary commands on the underlying operating system. The privileges granted are those of the process running the JSONata engine, which could range from a standard user account to root or administrator levels depending on deployment configurations. This compromise undermines data integrity and confidentiality, as well as potentially leading to full control over the affected server infrastructure.
From a classification perspective, this vulnerability aligns with CWE-94, Improper Control of Generation of Code (Code Injection), due to the execution of arbitrary code via manipulated input. It also maps to ATT&CK technique T1059, Command and Scripting Interpreter, as it involves executing system commands through child_process. The root cause is categorized under CWE-284, Improper Access Control, specifically relating to insufficient validation during object property lookup operations that fail to respect intended security boundaries between the query language engine and the host runtime environment.
Mitigation strategies primarily involve upgrading JSONata to version 1.8.8 or later for the legacy branch, or version 2.2.1 and above for the current release line, where this prototype pollution bypass has been patched. For organizations unable to upgrade immediately, input validation should be implemented at the application layer to restrict which functions can be invoked by end-users. Additionally, running JSONata in a restricted environment with limited system access or using sandboxing technologies such as containers or virtual machines can reduce the blast radius of any potential exploitation attempts. Regular security audits and static analysis tools configured to detect prototype pollution patterns are also recommended to identify similar weaknesses in custom implementations of query languages.