Skip to main content
cve.nowby Sazabi
← npm
npmPackage

jsonata

6 known vulnerabilities (4 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.2.2 (Jul 16, 2026): no advisory affects it
Newest unaffected release
2.2.2 (Jul 16, 2026), the latest release
Advisories
6 · 4 critical, 1 high, 1 medium
Weekly downloads
2.9M
Dependents
776
Releases
59 since 1.0.0 (Sep 27, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-77415
    Affects 1.0.0 to 1.8.7 (1.8.8 is outside it); 2.0.0 to 2.2.0 (2.2.1 is outside it)
  • CVE-2026-77414
    Affects 1.0.0 to 1.8.7 (1.8.8 is outside it); 2.0.0 to 2.2.0 (2.2.1 is outside it)
  • CVE-2026-77413
    Affects 1.0.0 to 1.8.7 (1.8.8 is outside it); 2.0.0 to 2.1.1 (2.2.0 is outside it)
  • CVE-2026-52746
    Affects 1.0.0 to 1.8.8 (1.8.9 is outside it); 2.0.0 to 2.1.1 (2.2.0 is outside it)
  • CVE-2026-12208
    Affects 1.0.0 to 1.8.7 (1.8.8 is outside it); 2.0.0 to 2.2.0 (2.2.1 is outside it)
  • CVE-2024-27307
    Affects 1.4.0 to 1.8.6 (1.8.7 is outside it); 2.0.0 to 2.0.3 (2.0.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-77415Critical 9.3

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    Affected: from 2.0.0, fixed in 2.2.1; fixed in 1.8.8.

    Fixed in 1.8.8 (released Jul 16, 2026, 36 days before disclosure) and 2.2.1 (released May 19, 2026, 94 days before disclosure).

    The latest release, 2.2.2, is not affected.

    28% of jsonata downloads last week were affected versions (944.3K).

  • CVE-2026-77414Critical 9.3

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    Affected: from 2.0.0, fixed in 2.2.1; fixed in 1.8.8.

    Fixed in 1.8.8 (released Jul 16, 2026, 36 days before disclosure) and 2.2.1 (released May 19, 2026, 94 days before disclosure).

    The latest release, 2.2.2, is not affected.

    28% of jsonata downloads last week were affected versions (944.3K).

  • CVE-2026-77413Critical 9.3

    JSONata: Arbitrary Code Execution via crafted JSONata expressions

    Affected: fixed in 1.8.8; from 2.0.0, fixed in 2.2.0.

    Fixed in 1.8.8 (released Jul 16, 2026, 36 days before disclosure) and 2.2.0 (released May 14, 2026, 99 days before disclosure).

    The latest release, 2.2.2, is not affected.

    28% of jsonata downloads last week were affected versions (940.9K).

  • JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion

    Affected: from 2.0.0, fixed in 2.2.0; fixed in 1.8.9.

    Fixed in 1.8.9 (released Jul 30, 2026, 13 days after disclosure) and 2.2.0 (released May 14, 2026, 64 days before disclosure).

    The latest release, 2.2.2, is not affected.

    29% of jsonata downloads last week were affected versions (971.1K).

  • CVE-2026-12208Medium 6.9

    jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution

    Affected: fixed in 1.8.8; from 2.0.0, fixed in 2.2.1.

    Fixed in 1.8.8 (released Jul 16, 2026, 31 days after disclosure) and 2.2.1 (released May 19, 2026, 27 days before disclosure).

    The latest release, 2.2.2, is not affected.

    28% of jsonata downloads last week were affected versions (944.3K).

  • CVE-2024-27307Critical 9.8

    JSONata expression can pollute the "Object" prototype

    Affected: from 1.4.0, fixed in 1.8.7; from 2.0.0, fixed in 2.0.4.

    Fixed in 1.8.7 (released Mar 1, 2024, 5 days before disclosure) and 2.0.4 (released Feb 29, 2024, 6 days before disclosure).

    The latest release, 2.2.2, is not affected.

    1.5% of jsonata downloads last week were affected versions (50.5K).