Description
A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely.
Recommendation
Update the jsonata package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 2.2.1 < 1.8.8** Patched version(s): **2.2.1 1.8.8**
References
Could your website be exposed too?
SmartScanner can check your website for jsonata: Function Binding Prototype Pollution via hasOwnProperty Override and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty - CVE-2026-46681
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` - CVE-2026-44494
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026