Vulnerability · Published Jun 15, 2026 · Assigned by VulDB

CVE-2026-12208jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution

Medium 5.3

In plain English

A medium-severity prototype pollution in jsonata from jsonata-js. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	jsonata	1.8.8	GHSA-663r-x48j-fg8p
npm	jsonata	2.2.1	GHSA-663r-x48j-fg8p

Affected products (as reported)

Vendor	Product	Versions
jsonata-js	jsonata	2.02.12.2.0

Weakness: CWE-1321, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-370850 | jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution vdb-entry, technical-description
VDB-370850 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-12208 | CVE Analysis and Report third-party-advisory
Submit #832446 | jsonata-js jsonata 2.2.0 Prototype Pollution third-party-advisory
https://github.com/OriginSecurityX/jsonata-hasownproperty-bypass exploit