CVE-2026-77415: JSONata Query Language RCE Vulnerability

CVE-2026-77415 Overview

CVE-2026-77415 is a critical code injection vulnerability [CWE-94] in JSONata, a widely used JSON query and transformation language. Crafted JSONata expressions chain multiple object-integrity weaknesses to execute arbitrary code in the host process. The chain overwrites $clone, deconstructs internal functions through $merge.*, replaces proc.arguments.forEach, and forges internal lambda state. These primitives allow attackers to reach prototype getters, constructor access, and process.getBuiltinModule with child_process. Versions prior to 1.8.8 and 2.2.1 are affected.

Critical Impact
Attackers who can submit JSONata expressions to a vulnerable application achieve remote code execution with the privileges of the host Node.js process.

Affected Products

JSONata versions prior to 1.8.8 (v1 branch)
JSONata versions prior to 2.2.1 (v2 branch)
Any Node.js application embedding vulnerable JSONata releases

Discovery Timeline

2026-08-21 - CVE-2026-77415 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-77415

Vulnerability Analysis

JSONata evaluates user-supplied query expressions against JSON input. The vulnerability chains several object-integrity flaws to escape the evaluator sandbox and reach Node.js internals. Attackers overwrite the built-in $clone function to mutate internal objects through evaluateTransformExpression. The wildcard traversal in $merge.* exposes and deconstructs JSONata function objects and lambda closures.

Attackers then replace proc.arguments.forEach, which applyProcedure invokes when dispatching calls. Combined with forged lambda state, these primitives grant access to prototype getters and object constructors. From constructor access, the chain reaches process.getBuiltinModule('child_process'), enabling arbitrary command execution.

Root Cause

The evaluator did not distinguish function objects from plain objects during wildcard traversal, and internal maps used the shared Object.prototype chain. This let attacker-controlled property lookups reach prototype getters and constructors, violating the isolation assumed by the transform pipeline.

Attack Vector

Exploitation requires only the ability to submit a JSONata expression to a vulnerable evaluator. No authentication or user interaction is required. Any service that accepts user-supplied JSONata (for example, low-code platforms, workflow engines, or API gateways using it as a mapping language) is exposed over the network.

javascript

// Patch excerpt: src/jsonata.js — wildcards must not unwrap function objects (#800)
         if (Array.isArray(input) && input.outerWrapper && input.length > 0) {
             input = input[0];
         }
-        if (input !== null && typeof input === 'object') {
+        if (input !== null && typeof input === 'object' && !isFunction(input)) {
             Object.keys(input).forEach(function (key) {
                 var value = input[key];
                 if(Array.isArray(value)) {

Source: GitHub Commit 47c0e58

javascript

// Patch excerpt: src/functions.js — prevent object prototype pollution in $merge (#799)
         if (Array.isArray(arg)) {
             // merge the keys of all of the items in the array
-            var merge = {};
+            var merge = Object.create(null);
             for(var ii = 0; ii < arg.length; ii++) {
                 var allkeys = keys.call(this, arg[ii]);
                 allkeys.forEach(function (key) {

Source: GitHub Commit 59e2514

Detection Methods for CVE-2026-77415

Indicators of Compromise

JSONata expressions referencing $clone, $merge.*, constructor, prototype, or getBuiltinModule submitted through user-facing inputs.
Node.js processes hosting JSONata spawning unexpected child processes such as /bin/sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by the JSONata host process to unfamiliar destinations shortly after expression evaluation.
Application logs showing parse or evaluation errors correlated with unusually long or nested JSONata payloads.

Detection Strategies

Inspect application logs and HTTP request bodies for JSONata expressions containing child_process, constructor, or prototype-access strings.
Correlate JSONata evaluation events with process-creation telemetry from the Node.js runtime user.
Use software composition analysis to inventory JSONata versions across services and flag any release below 1.8.8 or 2.2.1.

Monitoring Recommendations

Alert on Node.js processes that hosted JSONata evaluation and subsequently invoked child_process APIs.
Baseline normal expression size and complexity per endpoint, then alert on outliers indicative of exploitation attempts.
Monitor egress from application servers hosting JSONata for connections to non-approved destinations.

How to Mitigate CVE-2026-77415

Immediate Actions Required

Upgrade JSONata to 1.8.8 (v1 branch) or 2.2.1 (v2 branch) immediately across all dependent services.
Audit direct and transitive dependencies with npm ls jsonata or equivalent, and rebuild container images that ship vulnerable versions.
Restrict who can submit JSONata expressions until upgrades are verified in production.

Patch Information

Maintainers released fixes in JSONata v1.8.8 and JSONata v2.2.1. The patches land across pull requests #799, #800, and #802. Full details are in the GitHub Security Advisory GHSA-66mm-25pp-rfff.

Workarounds

Treat JSONata expressions as untrusted code and reject or sanitize inputs containing constructor, prototype, $clone, or getBuiltinModule tokens.
Run the JSONata evaluator in a hardened Node.js worker with --disable-proto=delete and a restrictive seccomp or AppArmor profile that blocks execve.
Isolate JSONata processing behind a dedicated microservice with no outbound network access and minimal file-system privileges.

bash

# Upgrade JSONata to a patched release
npm install jsonata@2.2.1   # v2 consumers
npm install jsonata@1.8.8   # v1 consumers

# Verify no vulnerable versions remain in the dependency tree
npm ls jsonata