CVE-2026-77413: 
JavaScript vulnerability analysis and mitigation

CVE-2026-77413 is an arbitrary code execution vulnerability in JSONata, a JSON query and transformation language for Node.js. The flaw exists in versions up to and including 1.8.7 and in the 2.x branch prior to 2.2.0, due to a missing Object.prototype.hasOwnProperty check in the lookup function within src/functions.js. It was disclosed on August 21, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable lookup function in src/functions.js performed a direct property access (input[key]) on objects without first verifying that the key is an own property, allowing crafted JSONata expressions to traverse the JavaScript prototype chain. An attacker can exploit inherited prototype members — including __lookupSetter__, __defineGetter__, constructor, valueOf, and process.getBuiltinModule — to reach Node.js's child_process module and execute arbitrary OS commands. The fix, introduced in PR #794 and backported via PR #815, adds an Object.prototype.hasOwnProperty.call(input, key) guard to the lookup path and replaces unsafe Object.keys() calls with a safe utils.keys() wrapper throughout the codebase (GitHub Advisory, Fix Commit v2, Fix Commit v1).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands with the full privileges of the host Node.js process. This results in complete compromise of confidentiality, integrity, and availability of the affected system. Any application that evaluates user-supplied or externally sourced JSONata expressions is at risk, potentially enabling data exfiltration, file system manipulation, lateral movement within the hosting environment, or full server takeover (GitHub Advisory).

No public proof-of-concept exploit code has been confirmed as independently released, though the GitHub Security Advisory includes a working PoC expression demonstrating the attack chain. There is no evidence of active in-the-wild exploitation at the time of disclosure. The vulnerability requires no authentication and no user interaction, making it trivially automatable against any service that evaluates untrusted JSONata expressions. The EPSS score is approximately 0.41%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify a target: Locate an application or API endpoint that accepts and evaluates user-supplied JSONata expressions (e.g., data transformation services, integration platforms, or low-code tools using the jsonata npm package versions ≤ 1.8.7 or 2.0.0–2.1.x).
2. Craft a malicious expression: Construct a JSONata expression that abuses the missing hasOwnProperty check to traverse the prototype chain. The published PoC uses __lookupSetter__ to access __proto__, then chains constructor access to obtain a Function constructor reference.
3. Reach child_process: Use process.getBuiltinModule('child_process') via the constructed function to obtain a reference to Node.js's built-in child_process module, bypassing normal module resolution restrictions.
4. Execute arbitrary commands: Invoke execSync (or similar) with the desired OS command and {stdio: 'inherit'} to execute it with the privileges of the host process. Example PoC payload:

import jsonata from "jsonata";
const expression = jsonata(`
  (
    __lookupSetter__('__proto__')(constructor);
    __defineGetter__('l', constructor("return process.getBuiltinModule('child_process').execSync('id',{stdio:'inherit'}).toString()"));
    valueOf().l
  )
`);
await expression.evaluate({});

5. Achieve objective: Use the established command execution primitive to exfiltrate data, establish a reverse shell, or pivot further within the environment (GitHub Advisory).

• Logs: Application logs showing JSONata evaluation of expressions containing strings such as __lookupSetter__, __defineGetter__, __proto__, constructor, getBuiltinModule, child_process, or execSync.
• Process: Unexpected child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unusual outbound connections from the application server to external IPs or domains, particularly on non-standard ports, shortly after JSONata expression evaluation events.
• File System: New or modified files in the application directory or temporary directories (e.g., /tmp/, %TEMP%) created by the Node.js process, such as web shells, scripts, or downloaded binaries.
• Application Behavior: Errors or exceptions in application logs referencing prototype chain traversal, unexpected child_process module access, or JSONata evaluation failures on expressions with prototype-related keywords.

Upgrade the jsonata npm package to version 2.2.0 (for the 2.x branch) or 1.8.8 (for the 1.x branch), both of which contain the security fix. If immediate patching is not possible, restrict JSONata expression evaluation strictly to trusted, internally generated expressions and never pass user-supplied or externally sourced input directly to jsonata().evaluate(). Organizations should audit all code paths where JSONata expressions originate to ensure no untrusted data can reach the evaluator (GitHub Advisory, v1.8.8 Release).

The vulnerability was reported by security researchers peaktwilight and c0rydoras and patched by JSONata maintainer andrew-coleman. The fix was merged on May 14, 2026, but the CVE and advisory were not published until August 21, 2026. Community discussion appeared on Mastodon and infosec.exchange shortly after disclosure, and the issue was referenced in automated CVE tracking repositories. Tenable added detection coverage via a cloud security plugin (GitHub Advisory).