jsonata vulnerabilities
CVEs whose affected-version data names the jsonata package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-77413Critical· 9.8JSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An…
CVE-2026-77414Critical· 9.8JSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, protot…
CVE-2026-77415Critical· 9.8JSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects thro…
CVE-2026-52746High· 7.5jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-12208Medium· 5.3jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override