JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Description

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to:

• overwriting $clone allowing mutation of objects via transforms (see evaluateTransformExpression)
• it being possible to destruct jsonata functions/lambdas (e.g. $merge.*)
• applyProcedure using proc.arguments.forEach and not `Array.prototype.

Recommendation

Update the jsonata package to the latest compatible version. Followings are version details:

• Affected version(s): **< 1.8.8

  >= 2.0.0, < 2.2.1**

• Patched version(s): **1.8.8

  2.2.1**

References

• GHSA-66mm-25pp-rfff
• CVE-2026-77415
• CWE-94
• CAPEC-310