CVE-2026-12208

Name of the Vulnerable Software and Affected Versions jsonata-js jsonata versions prior to 2.2.1

Description A weakness in the Function Binding Frame System component allows for prototype pollution, which is the improperly controlled modification of object prototype attributes. This issue occurs within the createFrame() function located in the src/jsonata.js file and can be triggered remotely.

Recommendations Update to a version later than 2.2.0. As a temporary workaround, restrict the use of the createFrame() function to minimize the risk of exploitation.