Read the docs
TI-2024-18145 Aliases CVE-2024-27307GHSA-fqg8-vfv7-8fj8

JSONata expression can pollute the "Object" prototype

Priority MEDIUM 52CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01422 73rd percentileScored 2026-11-07
Fix Fixed jsonata (jsonata-js): 1.8.7, 2.0.4jsonata (npm): 1.8.7, 2.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jsonata-jsjsonata1.4.0 to before 1.8.7; 2.0.0 to before 2.0.41.8.7, 2.0.4Patch availableCNA
—jsonata (npm)1.4.0 to before 1.8.71.8.7Patch availableGHSA-fqg8-vfv7-8fj8
—jsonata (npm)2.0.0 to before 2.0.42.0.4Patch availableGHSA-fqg8-vfv7-8fj8
  • jsonata Vendorjsonata-js Affected 1.4.0 to before 1.8.7; 2.0.0 to before 2.0.4 Fixed in 1.8.7, 2.0.4 Patch available CNA
  • jsonata (npm) Vendor— Affected 1.4.0 to before 1.8.7 Fixed in 1.8.7 Patch available GHSA-fqg8-vfv7-8fj8
  • jsonata (npm) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-fqg8-vfv7-8fj8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jsonata:jsonata:*:*:*:*:*:*:*:*1.4.0 to before 1.8.7; 2.0.0 to before 2.0.4VulnerableJsonata
  • cpe:2.3:a:jsonata:jsonata:*:*:*:*:*:*:*:* Versions 1.4.0 to before 1.8.7; 2.0.0 to before 2.0.4 Vulnerable ·Jsonata

Remediation

  • Fix · CNA jsonata (jsonata-js) Fixed in 1.8.7, 2.0.4
  • Fix · GHSA-fqg8-vfv7-8fj8 jsonata (npm) Fixed in 1.8.7 Advisory →
  • Fix · GHSA-fqg8-vfv7-8fj8 jsonata (npm) Fixed in 2.0.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1.2 for RHEL 9Fixed—
Not affected: 2 products
  • OpenShift Serverless
  • Red Hat Developer Hub 1.2 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27307
  2. 2026-10-03 Alias added: GHSA-fqg8-vfv7-8fj8

References

Patch 3

Advisory 2

Other 2

  • TI-2026-54005 JSONata: Arbitrary Code Execution via crafted JSONata expressions CVSS 4.0CRITICAL 9.3
  • TI-2026-54004 JSONata: Arbitrary Code Execution via crafted JSONata expressions CVSS 4.0CRITICAL 9.3
  • TI-2026-54003 JSONata: Arbitrary Code Execution via crafted JSONata expressions CVSS 4.0CRITICAL 9.3
  • TI-2026-10500 jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences