jsonata has 5 CVEs on record. 4 were published in the last 90 days. The busiest recent month was August 2026 with 3. The median CVSS is 6.4 (medium), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-94 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 1
Weakness classes
Products
- jsonata 5
Worst active — by depth score
CVE-2026-77415CriticalJSONata is a JSON query and transformation language52CVE-2026-77414CriticalJSONata is a JSON query and transformation language52CVE-2026-77413CriticalJSONata is a JSON query and transformation language52CVE-2026-52746High· 7.5jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion41CVE-2026-12208Medium· 5.3jsonata: Function Binding Prototype Pollution via hasOwnProperty Override29
jsonata vulnerabilities
CVEs affecting jsonata, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-77413CriticalJSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An…
CVE-2026-77414CriticalJSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, protot…
CVE-2026-77415CriticalJSONata is a JSON query and transformation language
JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects thro…
CVE-2026-52746High· 7.5jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-12208Medium· 5.3jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override