{"uuid": "efbabe39-3886-4902-a9ba-e4b6a2f279f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77414", "type": "seen", "source": "https://gist.github.com/alon710/c3aaed90ea510257bc4b82da4dd81787", "content": "# CVE-2026-77414: CVE-2026-77414: Critical Sandbox Escape and Remote Code Execution in JSONata via Prototype Pollution\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77414\n\n## Summary\nCVE-2026-77414 (GHSA-2943-5xfg-gq5f) is a critical sandbox escape and remote code execution vulnerability in the JSONata package. When JSONata processes untrusted expressions, it uses a vulnerable environment lookup check that can be shadowed by user-defined variables. Attackers can leverage this to traverse the prototype chain, reach the global Function constructor, and execute arbitrary system commands on the host machine.\n\n## TL;DR\nA critical vulnerability in JSONata permits attackers to bypass query sandbox isolation and achieve remote code execution by shadowing local lookup methods and traversing the prototype chain.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network\n- **CVSS v4.0**: 9.3 (Critical)\n- **Impact**: Remote Code Execution (RCE) / Sandbox Escape\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- JSONata npm package versions < 1.8.8 and >= 2.0.0 < 2.2.1\n- Node.js applications evaluating arbitrary or untrusted user-supplied JSONata query expressions\n- **jsonata**: < 1.8.8 (Fixed in: `1.8.8`)\n- **jsonata**: >= 2.0.0 < 2.2.1 (Fixed in: `2.2.1`)\n\n## Mitigation\n\n- Upgrade JSONata library dependency to secure releases.\n- Isolate expression evaluation inside low-privilege sandboxes (e.g., gVisor, Firecracker).\n- Sanitize or reject expressions that contain dynamic property shadow mappings.\n\n**Remediation Steps:**\n1. Identify all uses of the jsonata package in package.json and lockfiles.\n2. For JSONata 1.x, update the package dependency to version 1.8.8.\n3. For JSONata 2.x, update the package dependency to version 2.2.1.\n4. Run npm install or yarn install to apply the updates.\n5. Verify deployment using automated security scans or unit tests simulating the prototype traversal payload.\n\n## References\n\n- [JSONata Security Advisory GHSA-2943-5xfg-gq5f](https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f)\n- [JSONata Pull Request #799 - Mitigate Prototype Pollution and Sandbox Traversal](https://github.com/jsonata-js/jsonata/pull/799)\n- [JSONata Fix Commit 59e2514](https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2)\n- [JSONata Release Commit v2.2.1](https://github.com/jsonata-js/jsonata/commit/06fc08cacff16315edddec9632e98c8c7342785b)\n- [JSONata Release Announcement v1.8.8](https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8)\n- [JSONata Release Announcement v2.2.1](https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77414) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T21:32:06.152219Z"}