Arbitrary Code Execution in JSONata

JSONata versions prior to 2.2.1 and 1.8.8 are vulnerable to arbitrary code execution due to flaws in how the library processes and executes transformation expressions. An attacker can chain three specific vulnerabilities to escape the sandboxed environment: the ability to overwrite the internal $clone function, the ability to destruct internal JSONata lambdas, and an unsafe implementation of forEach within the applyProcedure function. By manipulating these primitives, an attacker can prototype-pollute the execution context and access Node.js built-in modules, such as child_process. This allows the execution of arbitrary system commands on the host running the JSONata engine. This vulnerability, tracked as CVE-2026-77415, poses a significant risk to applications that process untrusted user-supplied JSONata expressions.

Attack Chain

1. Attacker identifies an application endpoint that accepts and evaluates user-provided JSONata expressions.
2. Attacker submits a crafted JSONata payload that overwrites the $clone function to permit object mutation.
3. Attacker uses $merge to destruct internal JSONata functions or lambdas, enabling access to the execution context.
4. Attacker performs prototype pollution using the manipulated objects to access __lookupGetter__.
5. Attacker exploits the unsafe forEach implementation in applyProcedure to further refine the execution environment.
6. Attacker leverages the modified environment to bridge into the Node.js runtime and access the child_process built-in module.
7. Attacker executes system-level commands, such as execSync('sh'), to achieve full remote code execution.

Impact

Successful exploitation of CVE-2026-77415 allows for complete system compromise on any server running vulnerable versions of the JSONata library. The vulnerability affects all applications that allow users to submit dynamic JSONata queries, including data processing platforms, API transformation layers, and automation engines. Organizations using vulnerable versions should prioritize patching to 2.2.1 or 1.8.8 immediately to mitigate the risk of arbitrary command execution.

Recommendation

• Update the jsonata package to version 2.2.1 or 1.8.8 across all affected applications immediately.
• Implement strict input validation or sandboxing for any interface that evaluates user-supplied JSONata expressions.
• Scan dependencies to identify all instances of the vulnerable jsonata package within the software supply chain.