Skip to content
OpenAdvisories

Package · npm

jsonata

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-77415

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformE…

    jsonata-js jsonata jsonata npm
  • Critical 9.3
    CVE-2026-77414

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $const…

    jsonata-js jsonata jsonata npm
  • Critical 9.3
    CVE-2026-77413

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supp…

    jsonata-js jsonata jsonata npm
  • Critical 9.8
    CVE-2024-27307

    JSONata expression can pollute the "Object" prototype

    JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denia…

    jsonata-js jsonata renovate jsonata Wolfi npm