https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T12:57:54.383129+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2026-12627 bdu:2026-12627 2026-10-08T12:57:54.414193+00:00 bdu:2026-12627 https://vulnerability.circl.lu/vuln/cve-2026-77414 CVE-2026-77414 — JSONata: Arbitrary Code Execution via crafted JSONata expressions 2026-10-08T12:57:54.414263+00:00

Affected: jsonata-js jsonata

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.