CVE-2026-77413 jsonata-js CVE debrief

Who should care

Developers and administrators using JSONata in their applications should be aware of this vulnerability and take immediate action to upgrade to a patched version. Additionally, security teams and vulnerability management teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Operators and platform administrators should assess their product deployments for potential exposure and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring, detection, and logs for exposed assets should be reviewed for extra review, and exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and rollback/change windows should also be considered for exposed systems while remediation is scheduled and verified. Source tracking and compensating controls should be implemented to mitigate potential code execution risks. The JSONata library is used in various applications, and its vulnerability can have significant operational impact if exploited. Therefore, it is essential to prioritize patching to versions 1.8.8 or 2.2.0 to mitigate potential code execution risks. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets that need extra review should be checked. Asset inventory and rollback/change windows should be considered for exposed systems while remediation is scheduled and verified. Source tracking and compensating controls should be implemented to mitigate potential code execution risks. The JSONata library prior to versions 1.8.8 and 2.2.0 contains a critical vulnerability that allows for arbitrary code execution. This is due to a missing Object.prototype.hasOwnProperty check in the lookup function, which enables crafted expressions to access inherited prototype members, potentially leading to code execution with the privileges of the host process. Affected product deployments should be reviewed

Technical summary

The JSONata library prior to versions 1.8.8 and 2.2.0 contains a critical vulnerability (CVE-2026-77413) that allows for arbitrary code execution. This is due to a missing Object.prototype.hasOwnProperty check in the lookup function, which enables crafted expressions to access inherited prototype members, potentially leading to code execution with the privileges of the host process. Affected product deployments should be reviewed for exposure, and compensating controls should be considered while remediation is scheduled and verified.

Defensive priority

Organizations using JSONata should prioritize patching to versions 1.8.8 or 2.2.0 to mitigate potential code execution risks.

Recommended defensive actions

• Upgrade JSONata to version 1.8.8 or 2.2.0
• Review and restrict user-supplied expressions
• Implement additional monitoring for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE details indicate a critical vulnerability in JSONata versions prior to 1.8.8 and 2.2.0, allowing for arbitrary code execution via crafted expressions. Evidence is based on official CVE and NVD records. To verify, defenders should review the official advisory and CVE record for affected scope, severity, and vendor guidance. They should also assess their product deployments for potential exposure and plan for vendor-supported updates or mitigations.

Official resources