CVE-2026-77415Critical· 9.8▾ MidnightJSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects thro…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
— → 9.8
0.5% → 0.9%
Last analysed / modified upstream
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
jsonata >= 2.0.0, < 2.2.1jsonata < 1.8.8Patched in:
jsonata 2.2.1jsonata 1.8.8Source: https://github.com/advisories/GHSA-66mm-25pp-rfff
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77414Critical· 9.8JSONata is a JSON query and transformation language
CVE-2026-77413Critical· 9.8JSONata is a JSON query and transformation language
CVE-2026-12208Medium· 5.3jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
CVE-2026-57170High· 7.8Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents
CVE-2026-54757High· 7.8compliance-trestle: Trestle: Remote Code Execution via Server-Side Template Injection (CVE-2026-54757)
CVE-2026-46439High· 7.8compliance-trestle is a tooling platform for managing compliance as code