CVE-2026-77415: Sandbox Escape and Arbitrary Code Execution in JSONata Engine
Vulnerability ID: CVE-2026-77415
CVSS Score: 9.3
Published: 2026-08-21
A critical sandbox escape vulnerability in JSONata versions prior to 1.8.8 and 2.2.1 allows unauthenticated remote attackers to execute arbitrary code on the host machine. By submitting crafted JSONata expressions, an attacker can manipulate internal AST structures, bypass object clone helpers, spoof native function flags, and escape the evaluation environment to execute system commands through the Node.js runtime.
TL;DR
CVE-2026-77415 is a critical sandbox escape in JSONata enabling remote code execution by chaining object-integrity and prototype-related weaknesses to hijack internal AST structures.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-94: Improper Control of Generation of Code ('Code Injection')
- Attack Vector: Network (AV:N)
- CVSS v4.0: 9.3 (Critical)
- Exploit Status: Proof-of-Concept Primitives Documented
- KEV Status: Not Listed
- Affected Versions: < 1.8.8, >= 2.0.0, < 2.2.1
Affected Systems
- JSONata NPM package (jsonata)
-
jsonata: < 1.8.8 (Fixed in:
1.8.8) -
jsonata: >= 2.0.0, < 2.2.1 (Fixed in:
2.2.1)
Code Analysis
Commit: 59e2514
Prototype-less objects implementation for v2 hardening
Commit: 47c0e58
Restrict lambda traversal in wildcard and descendant operators
Commit: f174348
Validate and reject system reserved keys _jsonata_lambda and _jsonata_function
Commit: f09df84
Consolidation of prototype pollution hardening for v1
Commit: 4b217d5
Backporting of security fixes to v1 branch
Exploit Details
- GitHub Security Advisory: Advisory detailing sandbox escape primitives and mitigations
Mitigation Strategies
- Upgrade jsonata package to 1.8.8 (v1) or 2.2.1 (v2)
- Implement execution limits including stack depth and computation timeouts
- Isolate host environment runtimes within read-only, unprivileged container environments
Remediation Steps:
- Identify all occurrences of the jsonata dependency across development and production packages
- Update package.json dependencies to reference 'jsonata': '^2.2.1' or '^1.8.8'
- Run 'npm install' or 'yarn install' to pull the latest security patches
- Audit dependency locks using 'npm audit' or 'yarn audit' to verify patch resolution
- Configure compilation options with limits on execution time and stack size within software modules
References
- CVE-2026-77415 on CVE.org
- GitHub Security Advisory GHSA-66mm-25pp-rfff
- Official Fix Commit - v2 Prototype Hardening
- Official Fix Commit - v2 Wildcard Filtering
- Official Fix Commit - v2 Flag Blocking
- Official Fix Commit - v1 Backport Hardening
- Official Fix Commit - v1 Backport Implementation
Read the full report for CVE-2026-77415 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)