CVE-2026-77413

Received Received - Intake

Prototype Pollution in JSONata Leading to RCE

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-77413

EUVD

EUVD-2026-64155

Affected Vendors & Products

Vendor	Product	Version / Range
jsonata	jsonata	1.8.8
jsonata	jsonata	2.2.0
jsonata	jsonata	to 1.8.8\|end_excluding=2.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

JSONata versions before 1.8.8 and 2.2.0 have a flaw in the lookup function in src/functions.js. The function did not check Object.prototype.hasOwnProperty, allowing crafted expressions to access inherited prototype members. Attackers could exploit this to use prototype setters, getters, constructor access, valueOf, or process.getBuiltinModule to reach the child_process module and execute arbitrary code with the host process privileges.

Impact Analysis

If you use a vulnerable version of JSONata, an attacker could supply a malicious expression to execute arbitrary code on your system. This could lead to data theft, system compromise, or further network intrusions, depending on the privileges of the host process.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data processed, leading to legal and compliance risks for affected organizations.

Mitigation Strategies

Upgrade JSONata to version 1.8.8 or later, or 2.2.0 or later. This vulnerability is fixed in these versions.

Hi! I’m here to help you understand CVE-2026-77413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70