Количество 3
Количество 3
CVE-2026-77414
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
GHSA-2943-5xfg-gq5f
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
BDU:2026-12627
Уязвимость функции environment.lookup() модуля child_process программного средства преобразования json-данных JSONata, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-77414 JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1. | 0% Низкий | около 1 месяца назад | |
| GHSA-2943-5xfg-gq5f JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions | 0% Низкий | около 1 месяца назад | |
 | BDU:2026-12627 Уязвимость функции environment.lookup() модуля child_process программного средства преобразования json-данных JSONata, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.8 | 0% Низкий | 2 месяца назад |
Уязвимостей на страницу