CVE-2026-77413 is a prototype pollution vulnerability in JSONata's lookup() function. The flaw is straightforward: when evaluating expressions against objects, the library fails to check hasOwnProperty before accessing properties, allowing attackers to inject values into JavaScript's object prototype chain via proto, constructor, or prototype properties. The impact is arbitrary code execution in any deployment where untrusted JSON reaches JSONata — the library's presence in template engines, API gateways, and serverless functions means a single downstream consumer can become an attack vector without the attacker knowing JSONata exists at all.
The CVSS of 9.3 reflects how trivially exploitable this is once the trust assumption is violated. But the deeper problem isn't the missing check — it's where that assumption came from. JSONata's developers appear to have treated JavaScript objects as pure data containers rather than an inheritance graph with attack surface. This wasn't a flawed threat model; it was no threat model at all. The problem is that by 2026, prototype pollution is a well-documented attack class with a documented fix (hasOwnProperty or Object.prototype.hasOwnProperty.call). That the same pattern keeps appearing in expression-language libraries isn't coincidence — it's a structural incentive problem. The developers who write these libraries operate in data-transformation communities that don't monitor the same security mailing lists as the researchers who publish prototype pollution CVEs. The knowledge exists; the translation layer to library authors is broken.
Two immediate actions matter. First, verify whether your stack passes untrusted input to any JSONata evaluation — check template engines, API request handlers, and any code that evaluates expressions against request data. Second, if you're using JSONata server-side with access to process, child_process, or other Node.js globals, that's an architectural misuse, not a code problem. A hasOwnProperty guard fixes the lookup() function; it doesn't fix a deployment topology where a JSON query library is processing hostile strings in an environment with code execution capabilities.
The compounding risk the CVSS doesn't capture: JSONata sits deep in dependency trees as a transitive dependency. Your direct dependency might be patched while a frozen artifact or Lambda layer three hops down still carries the vulnerable version. The exposure window isn't just CVE-to-patch — it's patch-to-propagation through every layer of transitive dependency where this code is embedded.