Description
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jsonata-js jsonata
< 1.8.8affected>= 2.0.0, < 2.2.1affected
References
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f ↗
- https://github.com/jsonata-js/jsonata/pull/799 ↗
- https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2 ↗
- https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8 ↗
- https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1 ↗