External risk intelligence

JSONata Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-77415

JSONata is a library used to process JSON data. While it is commonly integrated into web applications and APIs that may process untrusted input, it is a development dependency rather than a standalone network service. Its reachability depends entirely on how an application developer implements it, making internet exposure possible but contingent on the specific deployment.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the JSONata data processing language that, if exploited, could allow attackers to execute arbitrary code on affected systems. This is due to a chaining of object-integrity weaknesses that can be triggered by specially crafted JSONata expressions.

Code execution through data processing.
Critical vulnerability impacting processing logic.
Confirm relevance and exposure of this library.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a chain of vulnerabilities within the JSONata library by submitting a specially crafted JSONata expression. This expression exploits weaknesses in object manipulation and function evaluation to gain control over internal states and execution context. By overwriting critical internal variables and methods, an attacker can ultimately access system-level modules, allowing for the execution of arbitrary code with the privileges of the host process.

No special access needed.
Malicious JSONata expression.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Crafted JSONata expressions could chain object-integrity weaknesses to execute arbitrary code, potentially overwriting object mutations, exposing internal functions, or replacing critical components. This could allow an attacker to reach prototype getters, constructor access, and execute code with the privileges of the host process when supported by the advisory.

Code execution on host process.
Chained weaknesses in JSON expressions.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The technical teams responsible for addressing this vulnerability will depend on how JSONata is integrated into your environment. Typically, application owners or platform teams developing services that process JSON data with JSONata expressions are the primary point of contact. The initial practical step is to inventory all systems and applications using JSONata, identify which are externally reachable or process untrusted input, and then confirm the accountable owner for remediation planning.

Application or platform teams own the fix.
Verify JSONata usage and reachability.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JSONata and what is it used for?

JSONata is a query and transformation language for JSON data. Developers use this library within applications to filter, restructure, and process JSON documents, often acting as a bridge between raw data input and application logic.

What does CVE-2026-77415 mean?

This is a Code Injection vulnerability (CWE-94) where specially crafted JSONata expressions can manipulate the library's internal state. By chaining these weaknesses, an attacker can bypass security controls to execute unauthorized commands on the server running the application.

How can an attacker trigger this bug?

An attacker triggers this by providing a malicious JSONata expression to an application that processes it. It does not require special system access or prior authentication; however, the bug is only triggered if the application accepts and evaluates untrusted input from a user or external source.

Is my system at risk?

Per Halo Surface Signal, risk depends on how your application uses the library. If your software uses JSONata to process untrusted data directly from the internet, it is at higher risk. If the library is only used for internal data processing that is not accessible to external users, the potential for exploitation is significantly lower.

What should I do to respond to this issue?

First, identify which of your applications or services include JSONata as a dependency. Once you have an inventory, determine if those services process untrusted input. If they do, prioritize updating the JSONata library to version 1.8.8 or 2.2.1, as these releases contain the necessary security patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.