Loading story…
Multiple critical vulnerabilities in JSONata allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as CVE-2026-77413, CVE-2026-77414, and CVE-2026-77415, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke process.getBuiltinModule and child_process. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement.
Project maintainers shipped a series of hardening changes across the 1.x and 2.x branches, including blocking $lookup access to prototype members, replacing vulnerable objects with Object.create(null), using safer Object.prototype.hasOwnProperty.call checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as _jsonata_lambda and _jsonata_function. Affected versions include releases before 1.8.8 and 2.x versions prior to 2.2.1, with fixes delivered through 1.8.8/1.8.9, 2.2.0, and 2.2.1; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
On August 21, 2026, CVE-2026-77415 was published for a critical JSONata sandbox escape and arbitrary code execution issue caused by multiple object-integrity weaknesses. The advisory says crafted expressions could chain these flaws to reach child_process execution, with fixes in versions 1.8.8 and 2.2.1.
On August 21, 2026, CVE-2026-77414 was published for a critical JSONata vulnerability in src/jsonata.js environment.lookup involving a bypassable hasOwnProperty check. The issue enables remote, unauthenticated arbitrary code execution via crafted JSONata expressions and is fixed in versions 1.8.8 and 2.2.1.
On August 21, 2026, CVE-2026-77413 was published for a JSONata flaw in src/functions.js lookup that allowed crafted expressions to access inherited prototype members and achieve arbitrary code execution. The advisory states affected versions were fixed in 1.8.8 and 2.2.0.
On July 15, 2026, jsonata-js committed backported security fixes to the v1 branch for release v1.8.9. The changes hardened prototype handling, blocked traversal into function-like objects, and rejected reserved internal property names such as _jsonata_lambda and _jsonata_function.
On May 19, 2026, jsonata-js committed a multi-file hardening patch to prevent prototype pollution and inherited-property abuse across expression evaluation, tuple handling, parsing, signatures, date/time parsing, and helper functions. The changes replaced unsafe object iteration and direct inherited-method use with Object.keys(), Object.prototype.hasOwnProperty.call, and Object.create(null).
On May 14, 2026, jsonata-js published JSONata 2.2.0, stating the release predominantly contained security-related fixes and enhancements addressing GHSA-86vw-mfpg-wwv9. The release notes specifically mention preventing $lookup from accessing object prototype members and adding expression resource guardrails.
On May 14, 2026, jsonata-js committed a change to prevent $lookup from accessing inherited JavaScript object prototype members by requiring own-property checks and ignoring inherited properties. The patch also updated tests so prototype-access and prototype-pollution attempts evaluate safely or fail with T1006.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcedeveloper.mozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public disclosure detailed **33 vulnerabilities** in the widely used C JSON library **cJSON**, affecting versions through **`1.7.19`** and prompting warnings for organizations that parse attacker-controlled JSON. The reported issues include memory-safety bugs, denial-of-service conditions, and logic flaws that can cause **silent data loss** or operations on the wrong object member. An `oss-sec` post said some of the problems had previously been reported with proof-of-concept code and unmerged fixes, while the library's development was described as largely stagnant. One of the tracked issues, **`CVE-2026-67216`**, is a **CWE-407** algorithmic complexity flaw in **`cJSON_Compare()`** that can be exploited for remote CPU exhaustion. The vulnerable function recursively traverses shared JSON subtrees twice without a depth guard, causing comparison time to grow exponentially with nesting depth; a small but deeply nested JSON document can therefore tie up a system for hours. Advisories recommend upgrading to a patched release when available, avoiding `cJSON_Compare()` on deeply nested input, validating JSON structure before comparison, and assessing whether cJSON should be replaced in exposed applications.
Aug 1, 2026
Alibaba disclosed a critical remote code execution flaw, tracked as **`CVE-2026-16723`**, in **fastjson 1.x** versions **`1.2.68` through `1.2.83`**, including the final 1.x release. The vulnerability is exploitable under the library’s default configuration, does **not** require AutoType to be enabled, and does **not** depend on a classpath gadget chain. Alibaba said common parsing entry points such as `JSON.parse` and `JSON.parseObject` are affected, and that specifying a target DTO class does not reliably block exploitation because attacker-controlled payloads can be embedded in `Object`- or `Map`-typed fields.
Aug 15, 2026
A critical deserialization vulnerability in **Fastjson 1.2.x** allows unauthenticated remote code execution by abusing the library’s internal type-resolution logic, bypassing traditional `autoType` blacklist and whitelist protections without requiring third-party gadget classes on the target system. Public disclosure and proof-of-concept details identified affected versions as **1.2.68 through 1.2.83** when **SafeMode** is disabled, with researchers noting that **Spring Boot fat-jar** classloading can enable attacker-controlled remote class loading over HTTP. Analysis indicates the flaw is most likely to produce full RCE on **JDK 8**, while newer JDK versions may limit impact to **SSRF** in some environments.
Jul 25, 2026