AIKIDO-2026-10858
jsonata is vulnerable to Prototype Pollution
81
High Risk
This Affects:
jsonataTL;DR
JSONata creates and iterates over ordinary JavaScript objects in several evaluator paths. Crafted input can interact with inherited properties or special prototype keys during object construction, merging, grouping, or iteration. This can pollute object prototypes or cause polluted inherited values to be processed as expression data. The fix uses null-prototype dictionaries, safe own-property checks, Object.keys() iteration, and safe array iteration across the evaluator.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jsonata is vulnerable to Prototype Pollution in versions 1.8.7 - 2.2.0.
How to fix this
Upgrade the jsonata library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant