Critical JSONata Sandbox Escape Enables Arbitrary Code Execution (CVE-2026-77414)

A GitHub Security Advisory (GHSA-2943-5xfg-gq5f) discloses a critical vulnerability in the jsonata npm package affecting versions prior to 2.2.1 (with a backport to 1.8.8). The flaw stems from a bypassable hasOwnProperty check in environment.lookup, which allows a crafted JSONata expression to reach a JavaScript Function-style constructor and execute arbitrary code. A public proof-of-concept demonstrates spawning a shell (child_process.execSync('sh')) purely from an untrusted JSONata expression passed to jsonata(...).evaluate().

Why It Matters

JSONata is widely embedded as a query/transformation language in Node.js applications, integration platforms, and low-code tooling — often specifically to let end users or downstream systems submit expressions for data mapping. Any application that evaluates JSONata expressions from untrusted or semi-trusted input (API consumers, workflow definitions, user-configurable transforms) is exposed to full remote code execution on the host running the evaluation, not just a sandbox escape within JSONata's expression language. Exploit status is currently reported as PoC-public, meaning working exploit code is already available, raising the urgency to patch or mitigate quickly.

What Defenders Should Watch For / Do Now

• Inventory Node.js services and dependencies for jsonata below 2.2.1 (or 1.8.8 on the 1.x branch) and upgrade immediately, especially anywhere expressions originate from external or lower-trust callers.
• Audit application code for any path where user- or partner-supplied strings are passed into jsonata(...).evaluate() without being treated as fully trusted, executable logic.
• Where upgrading isn't immediately possible, consider isolating JSONata evaluation in a restricted process/container/VM boundary and disabling or heavily restricting outbound shell/process execution from that context.
• Hunt for anomalous child-process spawns (e.g., sh, bash, or other shells) launched from Node.js processes that host JSONata evaluation, particularly correlated with inbound API requests carrying expression-like payloads.
• Review logs/telemetry for JSONata expression inputs containing suspicious constructs such as $constructor, __proto__, or hasOwnProperty manipulation patterns similar to the published PoC.

Developing Intel

This is a same-day advisory and details may evolve as the community assesses real-world exposure across projects embedding JSONata. Track the original GitHub Security Advisory for the authoritative fix versions and any updates: GHSA-2943-5xfg-gq5f.