CVE-2026-77414: CWE-94: Improper Control of Generation of Code ('Code Injection') in jsonata-js jsonata
CVE-2026-77414 is a critical code injection vulnerability in the jsonata-js library, specifically in the jsonata JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 are affected due to a bypassable hasOwnProperty check in the environment.lookup function. Crafted expressions can exploit this flaw to access the object prototype and invoke process.getBuiltinModule with child_process, leading to arbitrary code execution with the privileges of the host process. This vulnerability has a CVSS 4.0 score of 9.3, indicating high severity. The issue is fixed in versions 1.8.8 and 2.2.1.
AI Analysis
Technical Summary
The vulnerability in jsonata-js arises from improper control of code generation (CWE-94) in the environment.lookup function within src/jsonata.js. The function's hasOwnProperty check can be bypassed, allowing malicious expressions to leverage $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype. This enables invocation of process.getBuiltinModule with the child_process module, resulting in arbitrary code execution with host process privileges. Versions before 1.8.8 and 2.2.1 are affected. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. The issue is resolved in jsonata versions 1.8.8 and 2.2.1.
Potential Impact
Exploitation of this vulnerability allows an attacker to execute arbitrary code on the host system with the same privileges as the process running jsonata. This can lead to full system compromise depending on the privileges of the host process. The vulnerability is remotely exploitable without authentication and requires no user interaction, increasing its risk.
Mitigation Recommendations
This vulnerability is fixed in jsonata versions 1.8.8 and 2.2.1. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix in these versions.
CVE-2026-77414: CWE-94: Improper Control of Generation of Code ('Code Injection') in jsonata-js jsonata
Description
CVE-2026-77414 is a critical code injection vulnerability in the jsonata-js library, specifically in the jsonata JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 are affected due to a bypassable hasOwnProperty check in the environment.lookup function. Crafted expressions can exploit this flaw to access the object prototype and invoke process.getBuiltinModule with child_process, leading to arbitrary code execution with the privileges of the host process. This vulnerability has a CVSS 4.0 score of 9.3, indicating high severity. The issue is fixed in versions 1.8.8 and 2.2.1.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jsonata-js arises from improper control of code generation (CWE-94) in the environment.lookup function within src/jsonata.js. The function's hasOwnProperty check can be bypassed, allowing malicious expressions to leverage $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype. This enables invocation of process.getBuiltinModule with the child_process module, resulting in arbitrary code execution with host process privileges. Versions before 1.8.8 and 2.2.1 are affected. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. The issue is resolved in jsonata versions 1.8.8 and 2.2.1.
Potential Impact
Exploitation of this vulnerability allows an attacker to execute arbitrary code on the host system with the same privileges as the process running jsonata. This can lead to full system compromise depending on the privileges of the host process. The vulnerability is remotely exploitable without authentication and requires no user interaction, increasing its risk.
Mitigation Recommendations
This vulnerability is fixed in jsonata versions 1.8.8 and 2.2.1. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:55:27.024Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a88be20acd9273b49bcc7b9
Added to database: 08/21/2026, 21:07:44 UTC
Last enriched: 08/21/2026, 21:22:05 UTC
Last updated: 08/21/2026, 21:33:10 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.