CVE-2026-12208: fallo de gravedad media en jsonata-js jsonata
jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.3%
A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
jsonata-js · jsonataPoCs públicas encontradas — 1
cve_referencegithub.com/OriginSecurityX/jsonata-hasownproperty-bypassno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — jsonata-js jsonata
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-27307CRITICALJSONata expression can pollute the "Object" prototypeEPSS 1.4%CVE-2026-77415CRITICALJSONata: Arbitrary Code Execution via crafted JSONata expressionsEPSS 0.9%CVE-2026-77413CRITICALJSONata: Arbitrary Code Execution via crafted JSONata expressionsEPSS 0.7%CVE-2026-52746HIGHJSONata: Malicious inputs to "$toMillis" function can cause resource exhaustionEPSS 0.7%CVE-2026-77414CRITICALJSONata: Arbitrary Code Execution via crafted JSONata expressionsEPSS 0.6%