The vulnerability in jsonata-js (CVE-2026-77415) allows attackers to execute arbitrary code by chaining several object-integrity weaknesses in crafted JSONata expressions. These weaknesses include overwriting the $clone function to mutate objects, exposing and deconstructing JSONata functions or lambdas via $merge.*, replacing proc.arguments.forEach used by applyProcedure, and forging internal lambda state. Exploiting these primitives enables access to prototype getters, prototype and constructor properties, and the process.getBuiltinModule function with child_process, ultimately allowing code execution with the host process's privileges. The vulnerability affects versions prior to 1.8.8 and 2.2.1 and has been fixed in those versions.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the host system with the privileges of the process running jsonata-js. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 base score is 9.3, reflecting critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

The vendor has fixed this vulnerability in jsonata-js versions 1.8.8 and 2.2.1. Users should upgrade to at least these versions to remediate the issue. Since this is a cloud service, the vendor typically manages remediation for hosted environments; users should verify with their service provider that the fix has been applied. Patch status is confirmed as available.