jsonata

It has a clear README, types, release notes, provenance, and six active contributors, with recent releases and an organization-backed repository. GitHub Actions leave all six actions unpinned and give the publish workflow top-level write access, so tighten CI controls.

Latest 2.2.2

NPM

90%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The repository uses Babel and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Workflow audit

Both workflows were fully audited with no untrusted checkouts, injection findings, or high-severity issues. However, all six action references are unpinned and the publish workflow grants top-level write access, creating avoidable CI reproducibility and token-scope concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2026-77415 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 2.0.0 - 2.2.1 and 0.0.0 - 1.8.8.	0.0.0 - 1.8.82.0.0 - 2.2.1	Critical
CVE-2026-77414 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 2.0.0 - 2.2.1 and 0.0.0 - 1.8.8.	0.0.0 - 1.8.82.0.0 - 2.2.1	Critical
CVE-2026-77413 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.8.7 and 2.0.0 - 2.2.0.	0.0.0 - 1.8.72.0.0 - 2.2.0	Critical
CVE-2026-52746 jsonata is vulnerable to Inefficient Regular Expression Complexity in versions 2.0.0 - 2.2.0 and 0.0.0 - 1.8.9.	0.0.0 - 1.8.92.0.0 - 2.2.0	High
CVE-2026-12208 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.8.8 and 2.0.0 - 2.2.1.	0.0.0 - 1.8.82.0.0 - 2.2.1	Medium