https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:43:41.736224+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-02116 bdu:2024-02116 2026-10-08T21:43:41.824972+00:00 bdu:2024-02116 https://cve.radiocsirt.org/vuln/euvd-2026-158388 EUVD-2026-158388 2026-10-08T21:43:41.825074+00:00 EUVD-2026-158388 https://cve.radiocsirt.org/vuln/fkie_cve-2024-27307 fkie_cve-2024-27307 2026-10-08T21:43:41.825089+00:00

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.

 https://cve.radiocsirt.org/vuln/ghsa-fqg8-vfv7-8fj8 GHSA-fqg8-vfv7-8fj8 — JSONata expression can pollute the "Object" prototype 2026-10-08T21:43:41.825123+00:00

Affected: npm: jsonata

### Impact

In JSONata versions `>= 1.4.0, < 1.8.7` and `>= 2.0.0, < 2.0.4`, a malicious expression can use the [transform operator](https://docs.jsonata.org/other-operators#-------transform) to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions.

### Patch

This issue has been fixed in JSONata versions `>= 1.8.7` and `>= 2.0.4`. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible.

```patch --- a/src/jsonata.js +++ b/src/jsonata.js @@ -1293,6 +1293,13 @@ var jsonata = (function() { } for(var ii = 0; ii < matches.length; ii++) { var match = matches[ii]; + if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) { + throw { + code: "D1010", + stack: (new Error()).stack, + position: expr.position + }; + } // evaluate the update value for each match var update = await evaluate(expr.update, match, environment); // update must be an object @@ -1539,7 +1546,7 @@ var jsonata = (function() { if (t…

 https://cve.radiocsirt.org/vuln/gsd-2024-27307 gsd-2024-27307 2026-10-08T21:43:41.825175+00:00 gsd-2024-27307 https://cve.radiocsirt.org/vuln/rhea-2024:4071 RHEA-2024:4071 — Red Hat Enhancement Advisory: Red Hat Developer Hub 1.2 release 2026-10-08T21:43:41.825188+00:00

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools jsonata: malicious expression can pollute the "Object" prototype jinja2: accepts keys containing non-attribute characters requests: subsequent requests to the same host ignore cert verification

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0767 WID-SEC-W-2024-0767 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-08T21:43:41.825212+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand zu verursachen.