CVE-2026-77413: JSONata RCE Vulnerability

CVE-2026-77413 Overview

CVE-2026-77413 is a code injection vulnerability [CWE-94] in JSONata, a JSON query and transformation language widely used in Node.js applications. The lookup function in src/functions.js lacks an Object.prototype.hasOwnProperty check. Crafted expressions can traverse inherited prototype members to reach constructor, valueOf, and process.getBuiltinModule. An attacker who can supply a JSONata expression can load the child_process module and execute arbitrary code with the privileges of the host Node.js process. The issue affects all versions prior to 1.8.8 and 2.2.0.

Critical Impact
Remote code execution through prototype chain traversal in user-supplied JSONata expressions, granting attackers the full privileges of the host Node.js process.

Affected Products

JSONata versions prior to 1.8.8 (v1.x branch)
JSONata versions prior to 2.2.0 (v2.x branch)
Node.js applications embedding JSONata for user-supplied query evaluation

Discovery Timeline

2026-08-21 - CVE-2026-77413 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-77413

Vulnerability Analysis

JSONata evaluates expressions against JSON input by resolving path segments through the internal lookup helper. Before the fix, lookup performed a key access on any non-null object without verifying that the property was an own property. This design allowed attacker-controlled expressions to reach inherited members on Object.prototype, Function.prototype, and constructor chains.

Once prototype traversal succeeds, an attacker can reference constructor to obtain the Function constructor, invoke valueOf and inherited setters or getters, and pivot to process.getBuiltinModule. Loading child_process from that entry point yields exec or spawn, resulting in arbitrary command execution. The attack requires no authentication and executes over the network wherever JSONata evaluates untrusted expressions.

Root Cause

The root cause is missing own-property validation in the lookup function of src/functions.js. JSONata treated any successful property read as a valid data lookup, even when the value originated from the prototype chain. A secondary check in src/jsonata.js that attempted to block prototype access at update time was insufficient and was replaced.

Attack Vector

Exploitation targets any application that passes attacker-controllable strings to jsonata(expression).evaluate(input). The attacker submits a JSONata expression that walks from a benign object to a builtin constructor, materializes child_process, and invokes a shell command.

javascript

// Patch in src/functions.js - $lookup must check own properties only
// Before:
} else if (input !== null && typeof input === 'object' && !isFunction(input)) {
    result = input[key];
}
// After:
} else if (input !== null && typeof input === 'object' && Object.prototype.hasOwnProperty.call(input, key) && !isFunction(input)) {
    result = input[key];
}

Source: GitHub Commit 4c5f4ad

javascript

// Patch in src/functions.js - replace Object.keys with safe utils.keys wrapper
var properties = defaults;
if (typeof options !== 'undefined') {
    utils.keys(options).forEach(function (key) {
        properties[key] = options[key];
    });
}

Source: GitHub Commit 4b217d5

Detection Methods for CVE-2026-77413

Indicators of Compromise

JSONata expressions containing tokens such as constructor, prototype, __proto__, valueOf, or getBuiltinModule.
Node.js processes hosting JSONata that spawn unexpected child_process descendants such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections from application servers immediately following JSONata evaluation requests.
Application logs recording JSONata parse or evaluation errors referencing Function or built-in module names.

Detection Strategies

Inspect HTTP request bodies and query parameters that reach JSONata endpoints for prototype-related keywords.
Correlate JSONata evaluation events with process-creation telemetry to identify unexpected shell invocations.
Audit dependency manifests (package.json, package-lock.json, yarn.lock) for jsonata versions below 1.8.8 or 2.2.0.

Monitoring Recommendations

Enable process lineage monitoring on Node.js hosts to alert when the runtime spawns interactive shells.
Log the raw expression strings passed to jsonata() when the source is user-controlled, and forward the logs to a centralized SIEM.
Track file integrity on the node_modules/jsonata directory to detect unauthorized version pinning or downgrades.

How to Mitigate CVE-2026-77413

Immediate Actions Required

Upgrade JSONata to 1.8.8 for the v1 branch or 2.2.0 for the v2 branch immediately.
Rebuild and redeploy all container images and serverless bundles that vendor the vulnerable package.
Treat every JSONata expression sourced from external input as untrusted and validate it before evaluation.
Rotate any secrets accessible to the Node.js process if exploitation is suspected.

Patch Information

The maintainers released fixes in JSONata v1.8.8 and JSONata v2.2.0. The technical fixes are tracked in Pull Request #794 and detailed in GHSA-8gq3-vp5j-2grp. The primary patch adds an Object.prototype.hasOwnProperty.call(input, key) guard to the lookup function and replaces unsafe Object.keys calls with a utils.keys wrapper that filters inherited members.

Workarounds

If patching is not immediately possible, restrict JSONata evaluation to server-generated expressions only.
Run the Node.js process under a dedicated low-privilege account with no shell access and a restrictive seccomp or AppArmor profile.
Deploy an allowlist filter that rejects expressions containing constructor, prototype, __proto__, or getBuiltinModule tokens before invoking jsonata().

bash

# Update JSONata to a patched release
npm install jsonata@2.2.0 --save
# or, for applications pinned to the v1 line
npm install jsonata@1.8.8 --save

# Verify the installed version
npm ls jsonata