Security Advisory

CVE-2024-27307

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-03-06 19:24:16

Last updated 2024-08-13 17:23:40

Assigner GitHub_M

State PUBLISHED

Description

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.

← Browse all CVEs View on cve.org ↗