Critical JSONata RCE (CVE-2026-77413): Prototype Pollution Chain Enables Arbitrary Code Execution

The maintainers of JSONata, a widely used JSON query and transformation language for Node.js, disclosed a GitHub Security Advisory (GHSA-8gq3-vp5j-2grp, tracked as CVE-2026-77413) for versions prior to 2.2.0 and 1.8.8. According to the advisory, a missing hasOwnProperty check in the library's internal lookup function allows a specially crafted JSONata expression to reach JavaScript's prototype chain and ultimately invoke arbitrary code.

A public proof-of-concept accompanies the advisory. It chains __lookupSetter__('__proto__') and __defineGetter__ calls to reach the expression's constructor, then uses that to construct and execute a function that shells out via Node's child_process.execSync. In short: evaluating an untrusted JSONata expression against untrusted input can result in full remote code execution in the evaluating process.

Why It Matters

JSONata is commonly embedded in applications that accept user- or third-party-supplied query expressions — API gateways, low-code/no-code platforms, ETL and data-transformation pipelines, and integration middleware. Any service that evaluates a JSONata expression sourced from an untrusted party (even indirectly, such as a saved user template or webhook-configured transform) is a candidate for this vulnerability. The advisory reports exploit status as PoC-public, meaning working exploit code is already available; no CVSS score has been published by the source at this time.

What Defenders Should Do Now

• Inventory applications and services that depend on the jsonata npm package, including transitively via middleware, integration platforms, or low-code tools — npm ls jsonata or a software composition analysis (SCA) scan is the fastest path.
• Upgrade to JSONata 2.2.0 (or 1.8.8 on the 1.x line) as soon as feasible; the advisory states the fix removes the missing ownership check via PR #794.
• Until patched, treat any code path that evaluates a JSONata expression built from external/untrusted input as high risk — consider disabling or gating that functionality.
• From a hunting perspective, watch for anomalous child-process spawns (e.g., sh, bash, cmd.exe) originating from Node.js processes that host JSONata evaluation, and for unexpected outbound connections or file writes immediately following such spawns.
• Review application logs for unusually structured or obfuscated JSONata expressions containing patterns like __proto__, __lookupSetter__, or __defineGetter__, which are hallmarks of this exploitation technique.

This is developing, same-day intel published by the JSONata maintainers on 2026-08-21; details may be refined as the advisory matures. For the full technical writeup and PoC, see the original GitHub Security Advisory: GHSA-8gq3-vp5j-2grp.