Skip to content
OpenAdvisories

Package · npm

jsonata

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Critical 9.3
    CVE-2026-77415

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformE…

    jsonata-js jsonata jsonata npm
  • Critical 9.3
    CVE-2026-77414

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $const…

    jsonata-js jsonata jsonata npm
  • Critical 9.3
    CVE-2026-77413

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supp…

    jsonata-js jsonata jsonata npm
  • High 7.5
    CVE-2026-52746

    JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion

    JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evalu…

    jsonata-js jsonata jsonata npm
  • Medium 5.3
    CVE-2026-12208

    jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution

    A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object…

    jsonata-js jsonata jsonata npm
  • Critical 9.8
    CVE-2024-27307

    JSONata expression can pollute the "Object" prototype

    JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denia…

    jsonata-js jsonata jsonata npm