CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions
Attackers can execute arbitrary code by supplying crafted JSONata expressions that exploit prototype pollution in the lookup function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77413?
CVE-2026-77413 is a critical code injection vulnerability in jsonata-js jsonata, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-77413?
4 open source packages ship an affected version, including jsonata.
| Package | Affected | Fixed in |
|---|---|---|
jsonata npm | All versions | 1.8.8 |
jsonata npm | All versions | 1.8.8 |
jsonata npm | From 2.0.0 | 2.2.0 |
jsonata npm | From 2.0.0 | 2.2.0 |
How do I fix CVE-2026-77413?
Upgrade jsonata to a fixed version for your release line: 1.8.8 or 2.2.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-77413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77413 exists.
Sources
Also known as CLEANSTART-2026-AP70361, GHSA-8gq3-vp5j-2grp, MINI-4cf8-4rv5-wh6j, MINI-fjxx-xhj4-pqxh, MINI-v6f8-rv6m-xvff.