CVE-2026-77415: Sandbox Escape and Arbitrary Code Execution in JSONata Engine

JSONata is a lightweight query and transformation language designed for JSON data structures, commonly integrated within Node.js applications to filter, map, and manipulate data streams. Because JSONata is frequently deployed in multi-tenant environments—such as low-code platforms, integrations, and message brokers—the engine implements execution sandboxing boundaries. These boundaries are intended to prevent evaluated expressions from accessing parent process contexts or underlying system resources.

CVE-2026-77415 represents a complete failure of these sandboxing boundaries in JSONata versions prior to 1.8.8 (v1 branch) and 2.2.1 (v2 branch). The vulnerability corresponds to CWE-94: Improper Control of Generation of Code ('Code Injection'). By supplying a malformed expression, an attacker can execute arbitrary system commands within the privileges of the host Node.js application.

The attack surface is exposed in any endpoint or service that parses and evaluates user-controlled JSONata expressions. Because execution does not depend on elevated privileges or complex application configurations, this vulnerability poses a high risk of remote code execution on affected host environments.

The sandbox escape in CVE-2026-77415 is executed by chaining five distinct object-integrity and reference weaknesses in the JSONata interpreter. The first primitive involves bypassing JSONata's internal object cloning logic. To preserve input immutability, JSONata relies on an internal $clone utility. However, the evaluation context allows attackers to shadow or override this utility with a custom identity function: $clone := function($o) { $o }. Subsequent transformation loops then retrieve live references to the engine's internal evaluation structures instead of safe copies, granting direct mutation capabilities.

The second primitive leverages wildcards (.*) and descendant (**) operators to bypass lambda function encapsulation. The interpreter checks for traversable structures using typeof input === 'object'. Because functions evaluate as objects in JavaScript, this check allows the traversal of function properties. Attackers can leverage this to read and extract the internal properties of functions, such as the parsed AST structures and execution parameters.

Thirdly, the function execution logic in applyProcedure evaluated steps by directly calling the forEach method on proc.arguments. Because the array structure of arguments can be manipulated and shadowed via the cloned object mutations, the attacker can hijack this call. By redefining forEach to point to a custom method, the interpreter's native execution flow is rerouted into the attacker's execution scope. This allows the attacker to traverse the host's V8 prototype chain, retrieve the global execution context, and run arbitrary system commands.

To understand the structural causes of CVE-2026-77415, we must examine the differences in object instantiation and property verification. In vulnerable versions, internal objects like variables, bindings, and matched patterns were declared as standard JavaScript object literals ({}). These literals inherit properties from Object.prototype, which exposes them to prototype pollution and property shadowing attacks.

The remediation steps implemented in PR #799 and PR #806 address this issue by substituting object literals with prototype-less structures generated via Object.create(null). Method invocations on external inputs were also refactored to use static prototype dispatches instead of dynamic, instance-based calls:

// PRE-PATCH (jsonata.js)
const wordValues = {};
var matcher = {};
var bindings = {};
 
if (expr.hasOwnProperty('group')) { ... }
proc.arguments.forEach(function (param, index) { ... });
 
// POST-PATCH (jsonata.js)
const wordValues = Object.create(null);
var matcher = Object.create(null);
var bindings = Object.create(null);
 
if (Object.prototype.hasOwnProperty.call(expr, 'group')) { ... }
Array.prototype.forEach.call(proc.arguments, function (param, index) { ... });

To address wildcard traversal leaks (PR #800), the recursive structure checking logic in src/jsonata.js was modified. The updated code prevents wildcards from accessing properties within function objects by introducing an explicit check via !isFunction(input):

// PRE-PATCH (jsonata.js)
if (input !== null && typeof input === 'object') {
    Object.keys(input).forEach(function (key) { ... });
}
 
// POST-PATCH (jsonata.js)
if (input !== null && typeof input === 'object' && !isFunction(input)) {
    utils.keys(input).forEach(function (key) { ... });
}

Lastly, to prevent attackers from mimicking native lambda states, PR #802 added strict validation rules. Any attempts to write keys containing internal identifiers like _jsonata_lambda or _jsonata_function within a parsed expression are rejected, throwing error code D1013 during compilation.

An attack scenario begins with an unauthenticated remote user identifying an endpoint that processes JSONata expressions. The attacker supplies a payload designed to exploit the mutation and shadowing flaws. First, the payload overrides the clone routine to obtain a direct pointer to internal objects during a transformation step.

Next, the attacker utilizes the descendant operators to parse the internal structures of an existing system function. This leaks critical metadata which is then utilized to construct a fake lambda object. The attacker injects the private _jsonata_lambda: true key and defines an override for the forEach property.

During evaluation, the JSONata engine encounters the fake lambda and invokes the customized forEach routing. This switches execution context to standard Node.js prototype properties (such as __proto__ and constructor). From here, the attacker constructs a generic callback pointing to Function constructors, resolving the global process object or loading modules like child_process to execute arbitrary system commands.

A successful exploit of CVE-2026-77415 results in complete system compromise. Because the sandbox escape allows access to Node's global V8 context, the execution environment can load standard libraries to perform file writes, establish reverse shells, or modify active memory spaces. This impacts system confidentiality, integrity, and availability.

If the host application executes within a container without strict resource constraints, attackers can escalate privileges or pivot to other systems inside the network. This risk is amplified because JSONata is often used to parse dynamic workflows within integration layers and middleware.

The vulnerability does not require authentication or user interaction to execute. The lack of preconditions makes this an ideal target for automated exploitation when exposed to public-facing networks.

The primary remediation strategy for CVE-2026-77415 is upgrading to the patched releases. For deployments using the v1 ecosystem, upgrade the dependency to 1.8.8 or higher. For deployments using the v2 ecosystem, upgrade to 2.2.1 or higher. Verify installation and enforce updates using dependency auditing tools.

In addition to upgrading, developers should enforce runtime limitations during initialization. JSONata versions 2.2.0 and above support execution options to restrict resource consumption. Specifying maximum call stack depths and execution timeouts provides defense-in-depth against resource exhaustions and potential sandbox variants:

const jsonata = require('jsonata');
 
const options = {
    stack: 500,        // Mitigates deep call recursion
    timeout: 1000,     // Aborts execution after 1000ms
    sequence: 100000   // Restricts array allocation limits
};
 
const expression = jsonata(untrustedExpression, options);

Deploying Node.js processes within minimal, unprivileged container instances with read-only root filesystems is also recommended. This ensures that even if an execution escape occurs, command execution capabilities are heavily restricted by kernel policies and namespace isolation.