CVE-2026-77413: CVE-2026-77413: Remote Code Execution via Prototype Chain Bypass in JSONata Evaluator

#security #cve #cybersecurity

CVE-2026-77413: Remote Code Execution via Prototype Chain Bypass in JSONata Evaluator

Vulnerability ID: CVE-2026-77413
CVSS Score: 9.3
Published: 2026-08-21

A critical prototype pollution and sandbox escape vulnerability was discovered in the JSONata query and transformation library before versions 1.8.8 and 2.2.0. By providing a malicious JSONata expression that bypasses ownership checks on object properties, remote attackers can execute arbitrary code in the context of the host Node.js application.

TL;DR

Unauthenticated remote code execution vulnerability in JSONata via prototype lookup chain traversal.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-94
Attack Vector: Network
CVSS Score: 9.3 (Critical)
EPSS Score: N/A
Impact: Unauthenticated Remote Code Execution
Exploit Status: Proof of Concept (PoC) documented
KEV Status: Not Listed

Affected Systems

jsonata npm package
Node.js applications evaluating untrusted JSONata queries

Exploit Details

GitHub Advisory: Proof of concept showing how standard prototype properties can retrieve the global Function constructor to run arbitrary commands via process.getBuiltinModule.

Mitigation Strategies

Upgrade JSONata to latest version (1.8.8+ or 2.2.0+)
Enable execution timeouts and stack limits
Sanitize and validate untrusted JSONata expressions before execution

Remediation Steps:

Identify all projects running vulnerable versions of jsonata.
Execute 'npm install jsonata@latest' to update to a secure version.
Integrate execution guardrails like execution timeout and stack depth limit options in the JSONata configuration when evaluating user input.

References

Read the full report for CVE-2026-77413 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community