Threats affecting pkg:npm/jsonata

CVE-2026-77415 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 are affected. Crafted JSONata expressions could chain multiple object-integrity weaknesses to execute arbitrary code with the privileges of the host process. The vulnerability allows attackers to manipulate internal functions and access prototype and constructor properties, ultimately enabling code execution. This issue is fixed in versions 1.8.8 and 2.2.1.

CVE-2026-77414 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 contain a flaw in the environment.lookup function where a bypassable hasOwnProperty check allows crafted expressions to access the object prototype and execute arbitrary code via process.getBuiltinModule with child_process. This vulnerability enables attackers to execute code with the privileges of the host process. The issue is fixed in jsonata versions 1.8.8 and 2.2.1.

CVE-2026-77413 is a critical code injection vulnerability in the jsonata-js library, affecting versions prior to 1.8.8 and 2.2.0. The flaw arises from the lookup function in src/functions.js lacking a proper hasOwnProperty check, allowing crafted expressions to access inherited prototype members. This enables an attacker who can supply expressions to execute arbitrary code with the privileges of the host process. The vulnerability is fixed in jsonata versions 1.8.8 and 2.2.0.

A vulnerability in the jsonata library's $toMillis function allows crafted inputs to cause excessive regex backtracking, leading to denial of service. This affects versions prior to 2.2.0 and 1.8.9. The issue is fixed in jsonata 2.2.0 and 1.8.9. The vulnerability has a high severity score of 7.5 CVSS 3.1 and does not impact confidentiality or integrity but causes availability disruption.

CVE-2026-12208 is a medium severity vulnerability in jsonata-js jsonata up to version 2.2.0. It involves improper control over modification of object prototype attributes within the createFrame function in src/jsonata.js. This vulnerability can be exploited remotely without authentication and does not require user interaction. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available.