jsonata
JSON query and transformation language
90%
Total Score
100
100
95
88
100
Health Score Breakdown
The repository uses Babel and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.
Both workflows were fully audited with no untrusted checkouts, injection findings, or high-severity issues. However, all six action references are unpinned and the publish workflow grants top-level write access, creating avoidable CI reproducibility and token-scope concerns.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-77415 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 2.0.0 - 2.2.1 and 0.0.0 - 1.8.8. | 0.0.0 - 1.8.82.0.0 - 2.2.1 | Critical |
CVE-2026-77414 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 2.0.0 - 2.2.1 and 0.0.0 - 1.8.8. | 0.0.0 - 1.8.82.0.0 - 2.2.1 | Critical |
CVE-2026-77413 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.8.7 and 2.0.0 - 2.2.0. | 0.0.0 - 1.8.72.0.0 - 2.2.0 | Critical |
CVE-2026-12208 jsonata is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.8.8 and 2.0.0 - 2.2.1. | 0.0.0 - 1.8.82.0.0 - 2.2.1 | Medium |
AIKIDO-2026-10996 jsonata is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 2.1.1. | 0.0.1 - 2.1.1 | High |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 10 years ago
- Unpacked Size
- 0.9 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.