CVE-2026-77413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77413", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:55:27.024Z", "datePublished": "2026-08-21T20:47:08.457Z", "dateUpdated": "2026-08-24T19:42:37.844Z"}, "containers": {"cna": {"title": "JSONata: Arbitrary Code Execution via crafted JSONata expressions", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"}, {"name": "https://github.com/jsonata-js/jsonata/pull/794", "tags": ["x_refsource_MISC"], "url": "https://github.com/jsonata-js/jsonata/pull/794"}, {"name": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e", "tags": ["x_refsource_MISC"], "url": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e"}, {"name": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d", "tags": ["x_refsource_MISC"], "url": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d"}, {"name": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8"}, {"name": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"}], "affected": [{"vendor": "jsonata-js", "product": "jsonata", "versions": [{"version": "< 2.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:47:08.457Z"}, "descriptions": [{"lang": "en", "value": "JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0."}], "source": {"advisory": "GHSA-8gq3-vp5j-2grp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T19:42:13.845372Z", "id": "CVE-2026-77413", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:42:37.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77413", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T19:42:13.845372Z"}}}], "references": [{"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:42:32.917Z"}}], "cna": {"title": "JSONata: Arbitrary Code Execution via crafted JSONata expressions", "source": {"advisory": "GHSA-8gq3-vp5j-2grp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jsonata-js", "product": "jsonata", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "references": [{"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "name": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jsonata-js/jsonata/pull/794", "name": "https://github.com/jsonata-js/jsonata/pull/794", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e", "name": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d", "name": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8", "name": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0", "name": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:47:08.457Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77413", "state": "PUBLISHED", "dateUpdated": "2026-08-24T19:42:37.844Z", "dateReserved": "2026-08-20T19:55:27.024Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T20:47:08.457Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jsonata", "vendor": "jsonata-js", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0."}, {"lang": "es", "value": "JSONata es un lenguaje de consulta y transformaci\u00f3n de JSON. Antes de las versiones 1.8.8 y 2.2.0, la funci\u00f3n lookup en src/functions.js carec\u00eda de una comprobaci\u00f3n Object.prototype.hasOwnProperty y permit\u00eda que expresiones manipuladas accedieran a miembros de prototipo heredados. Un atacante capaz de proporcionar una expresi\u00f3n podr\u00eda usar setters y getters de prototipo heredados, acceso al constructor, valueOf y process.getBuiltinModule para alcanzar el m\u00f3dulo child_process y ejecutar c\u00f3digo arbitrario con los privilegios del proceso anfitri\u00f3n. Este problema est\u00e1 solucionado en las versiones 1.8.8 y 2.2.0."}], "id": "CVE-2026-77413", "lastModified": "2026-10-12T16:10:00.220", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77413", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T19:42:13.845372Z", "version": "2.0.3"}}]}, "published": "2026-08-21T21:17:07.267", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e"}, {"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d"}, {"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/pull/794"}, {"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jsonata", "source": "cna", "vendor": "jsonata-js"}, "product": "jsonata", "vendor": "jsonata-js"}], "created": "2026-08-21T22:45:04.446857+00:00", "updated": "2026-08-21T23:00:14.783961+00:00", "vendors": ["jsonata-js", "jsonata-js$PRODUCT$jsonata"]}