CVE-2026-77414

Received Received - Intake

Prototype Pollution in JSONata Leading to RCE

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-77414

EUVD

EUVD-2026-64083

Affected Vendors & Products

Vendor	Product	Version / Range
jsonata	jsonata	to 1.8.8 (inc)
jsonata	jsonata	to 2.2.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

JSONata versions before 1.8.8 and 2.2.1 have a vulnerability in the environment.lookup function where a bypassable hasOwnProperty check allows crafted expressions to access the object prototype. Attackers can use $hasOwnProperty, $spread, $string, prototype access, and $constructor to execute arbitrary code via process.getBuiltinModule with child_process, gaining host process privileges.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the same privileges as the JSONata host process. If you use vulnerable versions, an attacker could take control of your application, steal data, or perform unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance risks include fines, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update JSONata to version 1.8.8 or 2.2.1 or later to address the prototype pollution vulnerability in the environment.lookup function.

Hi! I’m here to help you understand CVE-2026-77414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70