[CVE-2026-52746] JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs t…

Descripción técnica

JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0.

Puntuación CVSS

Score: 7.5/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

Jsonata — Jsonata

Debilidades (CWE)

CWE-1333

Fuente oficial

Publicado en NIST NVD.