CVE-2026-77415: 
JavaScript vulnerability analysis and mitigation

CVE-2026-77415 is a critical arbitrary code execution vulnerability in JSONata, a JSON query and transformation language. Crafted JSONata expressions can chain multiple object-integrity weaknesses to execute arbitrary code on the host system. Affected versions are all releases prior to 1.8.8 (1.x branch) and releases from 2.0.0 up to but not including 2.2.1 (2.x branch). The vulnerability was publicly disclosed on August 21, 2026, via a GitHub Security Advisory. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and stems from three chained weaknesses in JSONata's evaluator (GitHub Advisory). First, the built-in $clone function can be overwritten, allowing object mutation via evaluateTransformExpression. Second, wildcard operators (*, **) could unwrap and expose the internal properties of JSONata function/lambda objects (e.g., via $merge.*), which was fixed by PR #800 to prevent wildcards from traversing function internals (PR #800). Third, applyProcedure used proc.arguments.forEach instead of Array.prototype.forEach, making it susceptible to prototype manipulation; additionally, internal _jsonata_lambda and _jsonata_function flags could be forged via object constructors (PR #802). Chaining these primitives allows an attacker to reach prototype getters, access constructor, and ultimately call process.getBuiltinModule('child_process') to execute OS commands. A public proof-of-concept is included in the advisory (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the host process running JSONata. This results in full compromise of confidentiality, integrity, and availability of the vulnerable system. Any application that accepts user-supplied JSONata expressions and evaluates them server-side is at risk, potentially enabling data exfiltration, lateral movement within the hosting environment, or complete system takeover (GitHub Advisory).

A working proof-of-concept exploit is publicly available and included directly in the GitHub Security Advisory, demonstrating full remote code execution via child_process.execSync (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any attacker who can submit a JSONata expression to a vulnerable application. As of the disclosure date, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.51%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify a target: Locate an application that accepts and evaluates user-supplied JSONata expressions server-side using a vulnerable version of the jsonata npm package (< 1.8.8 or >= 2.0.0, < 2.2.1).
2. Craft the malicious expression: Construct a JSONata expression that chains the three weaknesses — overwriting $clone, using $merge.* to expose lambda internals, and forging _jsonata_lambda flags — to reach the JavaScript prototype chain.
3. Access prototype and constructor: Use the exposed lambda internals to call __lookupGetter__ and traverse to __proto__, then access the constructor function.
4. Execute OS command: Invoke constructor("return process.getBuiltinModule('child_process').execSync('COMMAND', {stdio:'inherit'})")() within the crafted expression to run arbitrary shell commands as the host process user.
5. Submit the payload: Send the crafted expression to the target application's JSONata evaluation endpoint (e.g., via HTTP POST or API call).

The full PoC is publicly documented in the GitHub Security Advisory (GitHub Advisory).

• Logs: Application logs showing JSONata expression evaluation containing strings such as _jsonata_lambda, __lookupGetter__, __proto__, getBuiltinModule, or child_process.
• Process: Unexpected child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unusual outbound connections from the application server to external IPs shortly after JSONata expression evaluation, potentially indicating reverse shell or data exfiltration activity.
• File System: New or modified files in the application directory or temp directories created by the Node.js process user, such as web shells, scripts, or downloaded binaries.

Upgrade JSONata to version 2.2.1 (2.x branch) or 1.8.8 (1.x branch), which include fixes from pull requests #799, #800, and #802 (GitHub Advisory). The fixes include: using null-prototype objects (Object.create(null)) throughout the codebase, preventing wildcards from unwrapping function/lambda internals, using Array.prototype.forEach.call instead of arr.forEach, and blocking expressions from setting internal _jsonata_function/_jsonata_lambda flags (PR #799, PR #800, PR #802). If immediate patching is not possible, restrict or disable the ability for untrusted users to submit custom JSONata expressions to the application.

The vulnerability was credited to researcher c0rydoras and disclosed by JSONata maintainer andrew-coleman via GitHub Security Advisory on August 21, 2026 (GitHub Advisory). The advisory attracted attention in automated threat intelligence communities, with references appearing in CVE daily brief repositories and AI-driven threat intelligence trackers shortly after disclosure. Tenable added detection coverage via container security plugins (Feedly).