{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jsonata--1.8.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-77415"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jsonata (\u003e= 2.0.0, \u003c 2.2.1)","jsonata (\u003c 1.8.8)","jsonata (2.0.0 to 2.2.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","cve-2026-77415","software-vulnerability","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eJSONata versions prior to 2.2.1 and 1.8.8 are vulnerable to arbitrary code execution due to flaws in how the library processes and executes transformation expressions. An attacker can chain three specific vulnerabilities to escape the sandboxed environment: the ability to overwrite the internal \u003ccode\u003e$clone\u003c/code\u003e function, the ability to destruct internal JSONata lambdas, and an unsafe implementation of \u003ccode\u003eforEach\u003c/code\u003e within the \u003ccode\u003eapplyProcedure\u003c/code\u003e function. By manipulating these primitives, an attacker can prototype-pollute the execution context and access Node.js built-in modules, such as \u003ccode\u003echild_process\u003c/code\u003e. This allows the execution of arbitrary system commands on the host running the JSONata engine. This vulnerability, tracked as CVE-2026-77415, poses a significant risk to applications that process untrusted user-supplied JSONata expressions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint that accepts and evaluates user-provided JSONata expressions.\u003c/li\u003e\n\u003cli\u003eAttacker submits a crafted JSONata payload that overwrites the \u003ccode\u003e$clone\u003c/code\u003e function to permit object mutation.\u003c/li\u003e\n\u003cli\u003eAttacker uses \u003ccode\u003e$merge\u003c/code\u003e to destruct internal JSONata functions or lambdas, enabling access to the execution context.\u003c/li\u003e\n\u003cli\u003eAttacker performs prototype pollution using the manipulated objects to access \u003ccode\u003e__lookupGetter__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker exploits the unsafe \u003ccode\u003eforEach\u003c/code\u003e implementation in \u003ccode\u003eapplyProcedure\u003c/code\u003e to further refine the execution environment.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the modified environment to bridge into the Node.js runtime and access the \u003ccode\u003echild_process\u003c/code\u003e built-in module.\u003c/li\u003e\n\u003cli\u003eAttacker executes system-level commands, such as \u003ccode\u003eexecSync('sh')\u003c/code\u003e, to achieve full remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-77415 allows for complete system compromise on any server running vulnerable versions of the JSONata library. The vulnerability affects all applications that allow users to submit dynamic JSONata queries, including data processing platforms, API transformation layers, and automation engines. Organizations using vulnerable versions should prioritize patching to 2.2.1 or 1.8.8 immediately to mitigate the risk of arbitrary command execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the jsonata package to version 2.2.1 or 1.8.8 across all affected applications immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sandboxing for any interface that evaluates user-supplied JSONata expressions.\u003c/li\u003e\n\u003cli\u003eScan dependencies to identify all instances of the vulnerable jsonata package within the software supply chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T01:16:31Z","date_published":"2026-08-22T01:16:22Z","id":"https://feed.craftedsignal.io/briefs/2026-08-jsonata-rce/","summary":"The JSONata library contains a critical vulnerability (CVE-2026-77415) allowing unauthenticated attackers to achieve arbitrary code execution via maliciously crafted JSONata expressions.","title":"Arbitrary Code Execution in JSONata","url":"https://feed.craftedsignal.io/briefs/2026-08-jsonata-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Jsonata (\u003c 1.8.8)","version":"https://jsonfeed.org/version/1.1"}