This vulnerability affects the createFrame function of the Function Binding Frame System component in jsonata-js jsonata versions 2.0, 2.1, and 2.2.0. It allows an attacker to improperly modify object prototype attributes, which can lead to unexpected behavior or security issues in applications using the affected library. The vulnerability is remotely exploitable without privileges or user interaction. Although the exploit code is publicly available, there is no vendor response or official fix as of the publication date.

An attacker can remotely exploit this vulnerability to manipulate object prototype attributes in applications using the affected versions of jsonata-js jsonata. This may result in altered program behavior or potential security risks depending on the application context. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on integrity.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider applying additional application-level controls to limit exposure or avoid using affected versions if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.