CVE-2026-77415 in JSONata
Summary
by MITRE • 08/21/2026
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
JSONata serves as a powerful query and transformation language designed for processing JSON data, widely adopted in various software ecosystems for its flexibility and expressive power. However, prior to the release of versions 1.8.8 and 2.2.1, the implementation contained critical security flaws that allowed attackers to execute arbitrary code on the host system through crafted input expressions. This vulnerability stems from a complex chain of object-integrity weaknesses within the JSONata engine, which, when exploited in conjunction, bypassed internal safeguards and granted unauthorized access to sensitive runtime objects and functions. The core issue lies in how the interpreter handles object mutation and function application during the evaluation process, specifically within the evaluateTransformExpression method and related execution contexts.
The exploitation mechanism relies on chaining multiple primitive vulnerabilities to manipulate internal state variables that are typically protected from user-level modification. An attacker can craft a JSONata expression that overwrites the $clone variable, thereby mutating objects in ways intended only for internal use by the engine. This manipulation allows the adversary to expose and deconstruct JSONata functions or lambdas through specific merge operations denoted as $merge.*. Furthermore, the attack vector targets the applyProcedure function, specifically its usage of proc.arguments.forEach, enabling the attacker to forge internal lambda state. These primitives collectively provide a pathway to access prototype getters, manipulate constructor references, and interact with process.getBuiltinModule using the child_process module. By leveraging these capabilities, an adversary can effectively break out of the sandboxed environment intended for JSONata execution and execute arbitrary code with the same privileges as the host process running the application.
From a technical classification perspective, this vulnerability aligns with CWE-94, which covers Improper Control of Generation of Code (Code Injection), specifically in contexts where dynamic evaluation or interpretation of user-supplied input leads to remote code execution. The attack pattern also reflects aspects of CWE-20, Improper Input Validation, as the parser failed to adequately sanitize complex expression chains that attempted to abuse internal object properties and function references. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps to T1059, Command and Scripting Interpreter, where an attacker uses a scripting language like JavaScript via JSONata to execute commands on the system. The ability to access process.getBuiltinModule indicates a high level of privilege escalation within the Node.js runtime environment, allowing for persistent control or further lateral movement depending on the deployment context.
The operational impact of this vulnerability is severe, particularly in applications that accept untrusted JSON data and subsequently query it using JSONata without proper sanitization or sandboxing measures. Since the execution occurs with the privileges of the host process, a successful exploit could lead to complete system compromise, including data exfiltration, modification of critical files, or use of the compromised server as a pivot point for further attacks in a networked environment. This risk is amplified in microservices architectures where JSONata might be used extensively for data transformation between services, potentially exposing multiple components if one service processes malicious payloads.
To mitigate this vulnerability, organizations must immediately upgrade to version 1.8.8 or later of the JSONata library, which includes patches that address these object-integrity weaknesses and restrict access to dangerous internal APIs. For environments where upgrading is not immediately feasible, implementing strict input validation on all user-supplied data before it reaches the JSONata engine can help reduce exposure. Additionally, running applications with minimal required privileges using principle of least privilege practices can limit the impact if an exploit were attempted. It is also advisable to review application logs for unusual patterns in query expressions that involve complex object manipulation or attempts to access internal properties like $clone or process modules. Regular security audits and static code analysis tools configured to detect dynamic evaluation risks should be employed to identify similar vulnerabilities in other parts of the software stack.