CVE-2026-77415

CVE-2026-77415 is a JSONata vulnerability with a 9.3 CVSS score, but the severity is deployment-dependent. The exploit chain—overwriting the $clone function, exposing lambdas through $merge, replacing proc.arguments.forEach, and forging lambda state—requires an attacker who controls the expression string. If your deployment processes JSONata expressions authored by your own team against trusted internal data, the exploit surface is minimal. If JSONata runs server-side evaluating untrusted client expressions, this is catastrophic. The attack is notable because it doesn't exploit a bug—it exploits intended functionality. $clone is a legitimate deep-copy operation that becomes a write primitive when an attacker controls the expression. Lambdas are evaluation targets repurposed as introspection and state-forgery vehicles. This is the same vulnerability class as the 2017-2019 prototype pollution wave in Lodash and similar libraries: trusted mutation primitives become execution vectors under hostile input. Patch to version 1.8.8 or 2.2.1 immediately if your threat model includes untrusted expression sources. However, assess whether the fix restricts extensibility patterns your workflows depend on—some legitimate use cases may break, and developers in that position face a choice between staying vulnerable or rewiring their code. The deeper problem is visibility: JSONata embeds in pipeline tools, low-code platforms, and serverless functions—often transitively, through acquired or forgotten components. Your SBOM may not flag it. The question to carry forward isn't just 'was this patched' but 'where is JSONata running as part of a workflow definition that gets re-evaluated, and is anyone monitoring that code path?'

Reviewed through automated stages and approved by a human before publication.