JSONata npm Package Vulnerability: Arbitrary Code Execution Risk
- Severity
- HIGH
- Affected component
- jsonata (npm)
- Affected versions
- >= 2.0.0, < 2.2.1 or < 1.8.8 or >= 2.0.0, < 2.2.1 or < 1.8.8 or >= 2.0.0, < 2.2.0 or < 1.8.9 or < 1.8.8 or >= 2.0.0, < 2.2.0 or >= 1.4.0, < 1.8.7 or >= 2.0.0, < 2.0.4
- Patched version
- 2.2.1 || 1.8.8
An early warning has been issued for a vulnerability in the JSONata npm package. Versions before 2.2.1 and 1.8.8 are reportedly vulnerable to arbitrary code execution via crafted JSONata expressions.
What happened
The JSONata npm package versions before 2.2.1 and 1.8.8 contain a vulnerability that allows arbitrary code execution. This is due to a bypassable hasOwnProperty check in the package, which can be exploited through specially crafted JSONata expressions. The vulnerability has been tracked under multiple GitHub Security Advisories, including GHSA-2943-5xfg-gq5f, GHSA-66mm-25pp-rfff, and GHSA-8gq3-vp5j-2grp. To assess your exposure, check if your project dependencies include JSONata in the affected version ranges.
The vulnerability has not been reported as exploited in the wild. However, given the severity and the potential for arbitrary code execution, it is critical to evaluate and mitigate the risk in your projects.
What to do about it
- Upgrade your JSONata npm package to version 2.2.1 or 1.8.8 to mitigate the risk of arbitrary code execution.
- Review your project dependencies to identify any instances of JSONata in the affected version ranges.
- If you are unable to immediately upgrade, consider implementing additional security measures to limit the impact of potential exploitation.
- Monitor the provided GitHub Security Advisories for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
jsonata is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project dependencies include JSONata npm package versions before 2.2.1 or 1.8.8.
What should I do right now?
Upgrade to JSONata version 2.2.1 or 1.8.8 to mitigate the risk of arbitrary code execution.
Has this vulnerability been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
Consult the GitHub Security Advisories GHSA-2943-5xfg-gq5f, GHSA-66mm-25pp-rfff, and GHSA-8gq3-vp5j-2grp for more detailed information.
Sources
- [GHSA-2943-5xfg-gq5f] JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- [GHSA-66mm-25pp-rfff] JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- [GHSA-8gq3-vp5j-2grp] JSONata: Arbitrary Code Execution via crafted JSONata expressions
- [GHSA-2943-5xfg-gq5f] JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions