CVE-2026-77414 JSONata: Arbitrary Code Execution via crafted JSONata expressions
Attackers can execute arbitrary code by crafting malicious JSONata expressions that bypass security checks to access Node.js process modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77414?
CVE-2026-77414 is a critical code injection vulnerability in jsonata-js jsonata, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Weakness: CWE-94
Which versions are affected by CVE-2026-77414?
4 open source packages ship an affected version, including jsonata.
| Package | Affected | Fixed in |
|---|---|---|
jsonata npm | All versions | 1.8.8 |
jsonata npm | All versions | 1.8.8 |
jsonata npm | From 2.0.0 | 2.2.1 |
jsonata npm | From 2.0.0 | 2.2.1 |
How do I fix CVE-2026-77414?
Upgrade jsonata to a fixed version for your release line: 1.8.8 or 2.2.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-77414 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77414 exists.
Sources
Also known as CLEANSTART-2026-JA64028, GHSA-2943-5xfg-gq5f, MINI-28hp-r8cp-hcc3, MINI-3q88-gmw8-6g3f, MINI-m8x9-c7m2-h683.