SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-77414

CRITICAL · CVSS 9.3 EPSS 0.43% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-21 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects JSONata versions prior to 1.8.8 and 2.2.1, where the environment.lookup function allows crafted expressions to bypass security checks, enabling attackers to execute arbitrary code with the host process's privileges. This critical flaw poses a significant risk to any application utilizing vulnerable versions of JSONata, particularly those handling untrusted input. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-77414
Severity
CRITICAL
CVSS
9.3
EPSS
0.43%

Original NVD Description

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.