CVE-2026-77414: 
JavaScript vulnerability analysis and mitigation

CVE-2026-77414 is an arbitrary code execution vulnerability in the JSONata JSON query and transformation library (npm package jsonata). It stems from a bypassable hasOwnProperty check in the environment.lookup function within src/jsonata.js, allowing crafted expressions to traverse the JavaScript object prototype chain and invoke process.getBuiltinModule('child_process') to execute arbitrary OS commands. Affected versions are all releases prior to 1.8.8 (1.x branch) and versions 2.0.0 through 2.2.0 (2.x branch). The vulnerability was disclosed on August 21, 2026, and carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) via prototype pollution. The createFrame function in src/jsonata.js initialized binding objects using var bindings = {}, which inherits from Object.prototype. The lookup function then checked for variable names using bindings.hasOwnProperty(name) — a call that can itself be overridden by a crafted expression. An attacker can reassign $hasOwnProperty to $spread($string) (neutralizing the guard), then access $__proto__ and $constructor to climb the prototype chain and call process.getBuiltinModule('child_process'), achieving arbitrary command execution. The fix (PR #799) replaced all {}-initialized objects with Object.create(null) (null-prototype objects) and replaced all obj.hasOwnProperty() calls with Object.prototype.hasOwnProperty.call(obj, ...) (GitHub Advisory, Fix PR #799).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the Node.js host process evaluating the JSONata expression. This results in full confidentiality, integrity, and availability compromise of the vulnerable system, including the ability to read sensitive data, modify files, establish persistence, or pivot to other systems on the network. Any application that evaluates user-supplied or externally sourced JSONata expressions without sandboxing is at risk (GitHub Advisory).

A working proof-of-concept (PoC) is publicly documented in the official GitHub Security Advisory, demonstrating exploitation in just a few lines of JavaScript. No evidence of in-the-wild exploitation has been reported as of the disclosure date, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.347%, reflecting low but non-negligible exploitation probability. No specific threat actor attribution has been made (GitHub Advisory).

1. Identify target: Locate applications that accept user-controlled input and pass it to JSONata's expression.evaluate() function, running JSONata versions < 1.8.8 or >= 2.0.0, < 2.2.1.
2. Craft malicious expression: Construct a JSONata expression that overrides the $hasOwnProperty binding to bypass the prototype guard:

(
  $hasOwnProperty := $spread($string);
  $__proto__ := $constructor;
  $constructor("return process.getBuiltinModule('child_process').execSync('id',{stdio:'inherit'})")();
)

3. Submit expression: Deliver the crafted expression as input to the vulnerable application endpoint (e.g., via an API request, form field, or configuration parameter that feeds into JSONata evaluation).
4. Achieve RCE: The expression bypasses the hasOwnProperty guard, traverses the prototype chain via $__proto__ and $constructor, and invokes process.getBuiltinModule('child_process').execSync() to run arbitrary OS commands as the host process user.
5. Post-exploitation: Use the established command execution to exfiltrate data, establish a reverse shell, or move laterally within the environment (GitHub Advisory).

• Logs: Application logs showing JSONata expression evaluation containing keywords such as $hasOwnProperty, $spread, $constructor, $__proto__, getBuiltinModule, or child_process.
• Process: Unexpected child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unusual outbound connections from the Node.js application server to external IPs, particularly on non-standard ports, following processing of user-supplied expressions.
• File System: New or modified files in the application directory or system temp directories created by the Node.js process user, including web shells, cron jobs, or SSH authorized_keys modifications.

Upgrade JSONata to version 2.2.1 (2.x branch) or 1.8.8 (1.x branch), both of which contain the fix (v2.2.1 Release, v1.8.8 Release). If immediate patching is not feasible, restrict the ability to evaluate untrusted or user-supplied JSONata expressions, or implement process-level sandboxing (e.g., running the evaluator in a separate isolated process with restricted OS privileges). Auditing all application entry points that pass external input to jsonata().evaluate() is strongly recommended as a prioritized remediation step.

The vulnerability was credited to researcher c0rydoras and published by andrew-coleman of the JSONata project on July 13, 2026, with the fix merged on May 19, 2026 (prior to public disclosure). The advisory received community attention on Mastodon/infosec.exchange and was referenced in automated CVE digest repositories. Tenable added detection coverage via container security plugins shortly after disclosure (GitHub Advisory).