Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to: - overwriting $clone allowing mutation of objects via transforms (see evaluateTransformExpression) - it being possible to destruct jsonata functions/lambdas (e.g. $merge.) - applyProcedure using proc.arguments.forEach and not Array.prototype.forEach Which could be chained to execute arbitrary code. This was fixed with: - https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/changes#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1673-R1673) - https://github.com/jsonata-js/jsonata/pull/800 - https://github.com/jsonata-js/jsonata/pull/802 Which are included in the 2.2.1 release. Fixes were then back-ported to the 1.8.8 release. PoC References - https://github.com/jsonata-js/jsonata/pull/799 -…
Recommended action: Upgrade to 2.2.1 or 1.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871 This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release. PoC
Recommended action: Upgrade to 2.2.1 or 1.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705 This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release. PoC
Recommended action: Upgrade to 2.2.0 or 1.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions. Patches This issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. References https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0 https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9 Credit Thank you to Doruk Tan Öztürk for disclosing this issue.
Recommended action: Upgrade to 2.2.0 or 1.8.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Recommended action: Upgrade to 2.2.1 or 1.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In JSONata versions = 1.4.0, < 1.8.7 and = 2.0.0, < 2.0.4, a malicious expression can use the transform operator to override properties on the Object constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. Patch This issue has been fixed in JSONata versions = 1.8.7 and = 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible. References https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4 Credit Thank you to Albert Pedersen of Cloudflare for disclosing this issue.
Recommended action: Upgrade to 2.0.4 or 1.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.