CVE-2026-77415: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to:

• overwriting $clone allowing mutation of objects via transforms (see evaluateTransformExpression)
• it being possible to destruct jsonata functions/lambdas (e.g. $merge.*)
• applyProcedure using proc.arguments.forEach and not Array.prototype.forEach

Which could be chained to execute arbitrary code.

This was fixed with:

• https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/changes#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1673-R1673)
• https://github.com/jsonata-js/jsonata/pull/800
• https://github.com/jsonata-js/jsonata/pull/802

Which are included in the 2.2.1 release. Fixes were then back-ported to the 1.8.8 release.