Go to packages list

jsonata

Ecosystem: npm

Downloads: 9.59 Mln

Vulnerabilities from the last (months)
  • 4CriticalAffects 8 versions
  • 1HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 2 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
6vulnerabilities
  • Critical4 (66.7%)
  • High1 (16.7%)
  • Medium0 (0.0%)
  • Moderate1 (16.7%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 3 vulnerabilities
    • Critical: 3
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (6)

Known vulnerabilities affecting jsonata, based on data from OSV.

Vulnerabilities affecting jsonata
IDSeveritySummaryAffected versionsPublishedSource
GHSA-2943-5xfg-gq5fCriticalJSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsBefore JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release. ## PoC ```js import jsonata
  • >= 2.0.0, < 2.2.1
  • < 1.8.8
GitHub (opens in a new tab)
GHSA-66mm-25pp-rfffCriticalJSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsBefore JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: - overwriting `$clone` allowing mutation of objects via transforms (see [`evaluateTransformExpression`](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1304-L1314)) - it being possible to destruct jsonata functions/lambdas (e.g. `$merge.*`) - [applyProcedure](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1670C20-L1675) using `proc.arguments.forEach` and not `Array.prototype.forEac
  • >= 2.0.0, < 2.2.1
  • < 1.8.8
GitHub (opens in a new tab)
GHSA-8gq3-vp5j-2grpCriticalJSONata: Arbitrary Code Execution via crafted JSONata expressions## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release. ## PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( __lookupSetter__('__proto__')(constructor); __defineGetter__('l', constructor
  • < 1.8.8
  • >= 2.0.0, < 2.2.0
GitHub (opens in a new tab)
GHSA-86vw-mfpg-wwv9Highjsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion### Impact Before JSONata `2.2.0` and `1.8.9`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions. ### Patches This issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate use
  • >= 2.0.0, < 2.2.0
  • < 1.8.9
GitHub (opens in a new tab)
GHSA-663r-x48j-fg8pModeratejsonata: Function Binding Prototype Pollution via hasOwnProperty OverrideA weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
  • < 1.8.8
  • >= 2.0.0, < 2.2.1
GitHub (opens in a new tab)
GHSA-fqg8-vfv7-8fj8CriticalJSONata expression can pollute the "Object" prototype### Impact In JSONata versions `>= 1.4.0, < 1.8.7` and `>= 2.0.0, < 2.0.4`, a malicious expression can use the [transform operator](https://docs.jsonata.org/other-operators#-------transform) to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. ### Patch This issue has been fixed in JSONata versions `>= 1.8.7` and `>= 2.0.4`. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The foll
  • >= 1.4.0, < 1.8.7
  • >= 2.0.0, < 2.0.4
GitHub (opens in a new tab)
  • GHSA-2943-5xfg-gq5fCritical
    JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
    • >= 2.0.0, < 2.2.1
    • < 1.8.8
    GitHub (opens in a new tab)

    Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release. ## PoC ```js import jsonata

    CVE: CVE-2026-77414

  • GHSA-66mm-25pp-rfffCritical
    JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
    • >= 2.0.0, < 2.2.1
    • < 1.8.8
    GitHub (opens in a new tab)

    Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: - overwriting `$clone` allowing mutation of objects via transforms (see [`evaluateTransformExpression`](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1304-L1314)) - it being possible to destruct jsonata functions/lambdas (e.g. `$merge.*`) - [applyProcedure](https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1670C20-L1675) using `proc.arguments.forEach` and not `Array.prototype.forEac

    CVE: CVE-2026-77415

  • GHSA-8gq3-vp5j-2grpCritical
    JSONata: Arbitrary Code Execution via crafted JSONata expressions
    • < 1.8.8
    • >= 2.0.0, < 2.2.0
    GitHub (opens in a new tab)

    ## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the `2.2.0` release, and ported in the `1.8.8` release. ## PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( __lookupSetter__('__proto__')(constructor); __defineGetter__('l', constructor

    CVE: CVE-2026-77413

  • GHSA-86vw-mfpg-wwv9High
    jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
    • >= 2.0.0, < 2.2.0
    • < 1.8.9
    GitHub (opens in a new tab)

    ### Impact Before JSONata `2.2.0` and `1.8.9`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions. ### Patches This issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate use

    CVE: CVE-2026-52746

  • GHSA-663r-x48j-fg8pModerate
    jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
    • < 1.8.8
    • >= 2.0.0, < 2.2.1
    GitHub (opens in a new tab)

    A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

    CVE: CVE-2026-12208

  • GHSA-fqg8-vfv7-8fj8Critical
    JSONata expression can pollute the "Object" prototype
    • >= 1.4.0, < 1.8.7
    • >= 2.0.0, < 2.0.4
    GitHub (opens in a new tab)

    ### Impact In JSONata versions `>= 1.4.0, < 1.8.7` and `>= 2.0.0, < 2.0.4`, a malicious expression can use the [transform operator](https://docs.jsonata.org/other-operators#-------transform) to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. ### Patch This issue has been fixed in JSONata versions `>= 1.8.7` and `>= 2.0.4`. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The foll

    CVE: CVE-2024-27307

Showing 1-6 of 6 vulnerabilities