In-app reader

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

GitHub AdvisoriesAugust 21, 2026Sign in to save

advisory github CVE-2026-77414 critical

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed i...

Discussion

Comments

No comments yet — start the thread.

Keep reading

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Comments

More on Bugflare

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Comments

More on Bugflare