jsonata-js vulnerabilities and threats

CVE-2026-77415 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 are affected. Crafted JSONata expressions could chain multiple object-integrity weaknesses to execute arbitrary code with the privileges of the host process. The vulnerability allows attackers to manipulate internal functions and access prototype and constructor properties, ultimately enabling code execution. This issue is fixed in versions 1.8.8 and 2.2.1.

CVE-2026-77414 is a critical code injection vulnerability in the jsonata-js library, a JSON query and transformation language. Versions prior to 1.8.8 and 2.2.1 contain a flaw in the environment.lookup function where a bypassable hasOwnProperty check allows crafted expressions to access the object prototype and execute arbitrary code via process.getBuiltinModule with child_process. This vulnerability enables attackers to execute code with the privileges of the host process. The issue is fixed in jsonata versions 1.8.8 and 2.2.1.

CVE-2026-77413 is a critical code injection vulnerability in the jsonata-js library, affecting versions prior to 1.8.8 and 2.2.0. The flaw arises from the lookup function in src/functions.js lacking a proper hasOwnProperty check, allowing crafted expressions to access inherited prototype members. This enables an attacker who can supply expressions to execute arbitrary code with the privileges of the host process. The vulnerability is fixed in jsonata versions 1.8.8 and 2.2.0.

JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.

CVE-2026-12208 is a medium severity vulnerability in jsonata-js jsonata up to version 2.2.0. It involves improper control over modification of object prototype attributes within the createFrame function in src/jsonata.js. This vulnerability can be exploited remotely without authentication and does not require user interaction. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available.