Summary
JSONata patched a critical vulnerability (CVE-2026-77413) that allows attackers to execute arbitrary code by exploiting a missing prototype check. The flaw enables full system takeover if an application processes malicious JSONata expressions.
Take Action:
If your applications or systems use the JSONata library, upgrade ASAP to version 1.8.8 (for 1.x) or 2.2.0 (for 2.x). Anything older can let an attacker run commands on your server. Until you can update, stop accepting JSONata expressions from users or treat any that you do accept as untrusted code.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)