CVE-2026-77414: JSONata Query Language RCE Vulnerability

CVE-2026-77414 Overview

CVE-2026-77414 is a code injection vulnerability [CWE-94] in JSONata, a JSON query and transformation language widely used in Node.js applications. Versions prior to 1.8.8 and 2.2.1 contain a bypassable hasOwnProperty check in the environment.lookup function of src/jsonata.js. Attackers can craft JSONata expressions that chain $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype. This chain reaches process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host Node.js process. The issue is fixed in versions 1.8.8 and 2.2.1.

Critical Impact
Any application that evaluates untrusted JSONata expressions can be exploited for unauthenticated remote code execution on the host process.

Affected Products

JSONata versions prior to 1.8.8 (1.x branch)
JSONata versions prior to 2.2.1 (2.x branch)
Node.js applications embedding vulnerable JSONata to evaluate user-supplied expressions

Discovery Timeline

2026-08-21 - CVE-2026-77414 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77414

Vulnerability Analysis

JSONata exposes a query and transformation language that is evaluated at runtime against JSON input. The environment.lookup function in src/jsonata.js resolves identifiers to values in the current evaluation environment. To restrict access to prototype-inherited properties, the function relied on a hasOwnProperty check. That check can be shadowed or bypassed when the caller controls the expression.

An attacker can chain the built-in functions $hasOwnProperty, $spread, and $string together with $constructor to walk from a normal object to Object.prototype and from there to the Node.js process object. Once process is reachable, process.getBuiltinModule('child_process') returns the child_process module, enabling invocation of exec, spawn, or execSync. The result is arbitrary command execution under the privileges of the Node.js host.

Root Cause

The root cause is unsafe use of plain JavaScript objects as lookup tables combined with a reliance on hasOwnProperty as a security boundary. Because hasOwnProperty resolves through prototype lookups controlled by the expression language, the guard can be shadowed. Internal state objects were also created as plain {} literals, exposing their prototype chain to expression-level access.

Attack Vector

Exploitation requires only the ability to submit a JSONata expression to a vulnerable evaluator. No authentication, user interaction, or local access is required when the evaluator is exposed over a network endpoint, such as a low-code platform, API gateway, workflow engine, or template renderer.

The official fix replaces prototype-bearing objects with Object.create(null), cutting off the prototype-walking chain used by exploitation payloads.

javascript

// Security patch in src/datetime.js - Prevent object prototype pollution (#799)
         return words;
     }
 
-    const wordValues = {};
+    const wordValues = Object.create(null);
     few.forEach(function (word, index) {
         wordValues[word.toLowerCase()] = index;
     });

Source: GitHub Commit 59e2514

javascript

// Security patch in src/functions.js - Prevent object prototype pollution (#799)
         if (Array.isArray(arg)) {
             // merge the keys of all of the items in the array
-            var merge = {};
+            var merge = Object.create(null);
             for(var ii = 0; ii < arg.length; ii++) {
                 var allkeys = keys.call(this, arg[ii]);
                 allkeys.forEach(function (key) {

Source: GitHub Commit 59e2514

Detection Methods for CVE-2026-77414

Indicators of Compromise

JSONata expressions containing $constructor, $spread, or references to prototype, process, getBuiltinModule, or child_process
Unexpected child processes such as sh, bash, cmd.exe, or powershell.exe spawned by a Node.js parent process running a JSONata-consuming service
Outbound network connections from a Node.js worker immediately after evaluation of a user-supplied expression
Presence of jsonata package versions below 1.8.8 or below 2.2.1 in package-lock.json or node_modules

Detection Strategies

Perform Software Composition Analysis (SCA) across build artifacts and container images to flag vulnerable JSONata versions.
Inspect application logs and HTTP request bodies for JSONata payloads referencing $constructor, getBuiltinModule, or child_process.
Correlate process-lineage telemetry to identify shell or scripting interpreters spawned from Node.js services that embed JSONata.

Monitoring Recommendations

Alert on Node.js processes spawning command interpreters or making outbound connections shortly after HTTP requests carrying expression payloads.
Monitor file writes to /tmp, /var/tmp, and application working directories from Node.js runtimes.
Track dependency drift so that new deployments cannot regress to pre-1.8.8 or pre-2.2.1 JSONata releases.

How to Mitigate CVE-2026-77414

Immediate Actions Required

Upgrade JSONata to 1.8.8 on the 1.x branch or 2.2.1 on the 2.x branch across all applications and container images.
Inventory every service that accepts user-supplied JSONata expressions and gate them behind authentication until patched.
Rotate secrets accessible to any Node.js process that evaluated untrusted expressions on vulnerable versions.

Patch Information

The maintainers released the fix in JSONata v1.8.8 and JSONata v2.2.1. The patch is tracked in Pull Request #799 and commit 59e2514. Full technical details are available in the GitHub Security Advisory GHSA-2943-5xfg-gq5f.

Workarounds

Reject or sanitize expressions containing $constructor, $spread, prototype, process, getBuiltinModule, or child_process tokens before evaluation.
Restrict JSONata evaluation to trusted, authenticated callers where feasible.
Run Node.js services that evaluate JSONata under a hardened least-privilege account with no shell access and restricted egress.

bash

# Upgrade to a patched JSONata release
npm install jsonata@2.2.1 --save
# Or, for applications pinned to the 1.x branch
npm install jsonata@1.8.8 --save

# Verify the resolved version
npm ls jsonata