A denial of service vulnerability exists in JSONata prior to version 2.2.0. The issue arises from the $toMillis function's ISO-8601 validation regex, which can cause superlinear backtracking when processing malicious non-matching inputs. This can lead to a denial of service in applications that evaluate user-provided JSONata expressions. The vulnerability is addressed in JSONata version 2.2.0. Affected sy [truncated]
A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attack [truncated]
