https://vulnerability.circl.lu/sightings/feed 2026-08-25T03:32:33.358511+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/73bfff1e-84c3-4862-8f57-675f26464948/export 2026-08-25T03:32:33.379414+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "73bfff1e-84c3-4862-8f57-675f26464948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77413", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtpz53xsi22d", "content": "Daily IT Security Digest \u2014 2026-08-22\nhttps://radar.offseq.com/threat/cve-2026-77413; https://radar.offseq.com/threat/cve-2026-77414-cwe-94; https://radar.offseq.com/threat/cve-2026-77415-cwe-94\n\n## 2. Microsoft August Patch Day: 22 Vulnerabilities Fixed, ShieldBreak Zero-Day", "creation_timestamp": "2026-08-23T05:02:19.154951Z"} 2026-08-23T05:02:19.154951+00:00 https://vulnerability.circl.lu/sighting/45e16cac-3a2f-43a9-be57-cbc85415d9e9/export 2026-08-25T03:32:33.381440+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "45e16cac-3a2f-43a9-be57-cbc85415d9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77413", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtpz53hn3h2s", "content": "Daily IT Security Digest \u2014 2026-08-22\nThree critical vulnerabilities (CVE-2026-77413, CVE-2026-77414, CVE-2026-77415) have been identified in the jsonata-js JavaScript library, with CVSS scores up to 9.3. The flaws involve code injection in the lookup function and object-integrity manipulation,", "creation_timestamp": "2026-08-23T05:02:18.465831Z"} 2026-08-23T05:02:18.465831+00:00 https://vulnerability.circl.lu/sighting/b54bba00-bdd8-407b-8e70-74726a305fc8/export 2026-08-25T03:32:33.381635+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b54bba00-bdd8-407b-8e70-74726a305fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77413", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtngv7w4u22x", "content": "CRITICAL: jsonata-js (<1.8.8, <2.2.0) vulnerable to code injection (CVE-2026-77413). Attackers can run arbitrary code. Upgrade to 1.8.8/2.2.0+ now. https://radar.offseq.com/threat/cve-2026-77413-cwe-94-improper-control-of-generation-of-code-code-injection-in-jsonata-js-jsonata-43a95a44c76d7f7e #O...", "creation_timestamp": "2026-08-22T04:30:28.596753Z"} 2026-08-22T04:30:28.596753+00:00 https://vulnerability.circl.lu/sighting/8cc5e679-03c2-46a9-87a1-c57cbe7d1250/export 2026-08-25T03:32:33.381770+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8cc5e679-03c2-46a9-87a1-c57cbe7d1250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77413", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117137278608318337", "content": "jsonata-js (<1.8.8, <2.2.0) is affected by CRITICAL CVE-2026-77413 (CVSS 9.3) due to a code injection flaw in the lookup function. Attackers can execute arbitrary code remotely. Upgrade to 1.8.8 or 2.2.0+ ASAP. https://radar.offseq.com/threat/cve-2026-77413-cwe-94-improper-control-of-generation-of-code-code-injection-in-jsonata-js-jsonata-43a95a44c76d7f7e #OffSeq #CVE #infosec #security", "creation_timestamp": "2026-08-22T04:30:26.527794Z"} 2026-08-22T04:30:26.527794+00:00 https://vulnerability.circl.lu/sighting/d23bea55-b214-49ca-96d4-c78cc7f309bd/export 2026-08-25T03:32:33.381891+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d23bea55-b214-49ca-96d4-c78cc7f309bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77413", "type": "seen", "source": "https://gist.github.com/alon710/1b32b1920b2d1520540a780d7d0490bd", "content": "# CVE-2026-77413: CVE-2026-77413: Remote Code Execution via Prototype Chain Bypass in JSONata Evaluator\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77413\n\n## Summary\nA critical prototype pollution and sandbox escape vulnerability was discovered in the JSONata query and transformation library before versions 1.8.8 and 2.2.0. By providing a malicious JSONata expression that bypasses ownership checks on object properties, remote attackers can execute arbitrary code in the context of the host Node.js application.\n\n## TL;DR\nUnauthenticated remote code execution vulnerability in JSONata via prototype lookup chain traversal.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Unauthenticated Remote Code Execution\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- jsonata npm package\n- Node.js applications evaluating untrusted JSONata queries\n\n## Mitigation\n\n- Upgrade JSONata to latest version (1.8.8+ or 2.2.0+)\n- Enable execution timeouts and stack limits\n- Sanitize and validate untrusted JSONata expressions before execution\n\n**Remediation Steps:**\n1. Identify all projects running vulnerable versions of jsonata.\n2. Execute 'npm install jsonata@latest' to update to a secure version.\n3. Integrate execution guardrails like execution timeout and stack depth limit options in the JSONata configuration when evaluating user input.\n\n## References\n\n- [GHSA-8gq3-vp5j-2grp](https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp)\n- [NVD Detail - CVE-2026-77413](https://nvd.nist.gov/vuln/detail/CVE-2026-77413)\n- [CVE.org - CVE-2026-77413](https://www.cve.org/CVERecord?id=CVE-2026-77413)\n- [JSONata v1.8.8 Release Notes](https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8)\n- [JSONata v2.2.0 Release Notes](https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77413) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T01:32:06.828249Z"} 2026-08-22T01:32:06.828249+00:00 https://vulnerability.circl.lu/sighting/fa61a637-a555-477e-bc67-f4b02efc4b9b/export 2026-08-25T03:32:33.382046+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fa61a637-a555-477e-bc67-f4b02efc4b9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77413", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmydloav52y", "content": "CVE-2026-77413 - jsonata\nVersions of the JSONata library older than 2.2.0 and 1.8.8 allow specially formed expressions to run any code on the server. An attacker who can supply a JSONata expression could execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jsonata #npm #CVE #infosec", "creation_timestamp": "2026-08-22T00:10:04.280318Z"} 2026-08-22T00:10:04.280318+00:00 https://vulnerability.circl.lu/sighting/587dcbea-d4d9-4027-a7c6-a2805de8c5dc/export 2026-08-25T03:32:33.382184+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "587dcbea-d4d9-4027-a7c6-a2805de8c5dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77413", "type": "published-proof-of-concept", "source": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp", "content": "", "creation_timestamp": "2026-08-21T22:35:10.405450Z"} 2026-08-21T22:35:10.405450+00:00 https://vulnerability.circl.lu/sighting/cdd1b3a5-d59c-4519-841d-8bb9dab8e30b/export 2026-08-25T03:32:33.383408+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "cdd1b3a5-d59c-4519-841d-8bb9dab8e30b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77413", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtmrjjdpmb2m", "content": "\ud83d\udea8 CVE-2026-77413 \u2014 CVSS 9.3 CRITICAL\n\nJSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77413\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T22:08:09.481952Z"} 2026-08-21T22:08:09.481952+00:00