https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T03:21:04.734142+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-77414 CVE-2026-77414 — JSONata: Arbitrary Code Execution via crafted JSONata expressions 2026-10-09T03:21:04.735820+00:00

Affected: jsonata-js jsonata

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.