CVE-2026-77415 JSONata: Arbitrary Code Execution via crafted JSONata expressions
Attackers can execute arbitrary code by crafting malicious JSONata expressions that exploit object-integrity weaknesses to access internal process modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77415?
CVE-2026-77415 is a critical code injection vulnerability in jsonata-js jsonata, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Weakness: CWE-94
Which versions are affected by CVE-2026-77415?
4 open source packages ship an affected version, including jsonata.
| Package | Affected | Fixed in |
|---|---|---|
jsonata npm | All versions | 1.8.8 |
jsonata npm | All versions | 1.8.8 |
jsonata npm | From 2.0.0 | 2.2.1 |
jsonata npm | From 2.0.0 | 2.2.1 |
How do I fix CVE-2026-77415?
Upgrade jsonata to a fixed version for your release line: 1.8.8 or 2.2.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-77415 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77415 exists.
Sources
Also known as CLEANSTART-2026-VX74445, GHSA-66mm-25pp-rfff, MINI-7p5x-mvqm-g26f, MINI-j3cq-jhg3-ff9h, MINI-vfgw-hmxh-5m46.