{"action":"Upgrade jsonata to 1.8.8 or later.","affected":[{"fixed":"1.8.8","introduced":"0"},{"fixed":"2.2.1","introduced":"2.0.0"}],"component":"jsonata","cve_ids":["CVE-2026-12208"],"ecosystem":"npm","epss":0.00314,"exploited":false,"fixed_versions":["1.8.8","2.2.1"],"ghsa_id":"GHSA-663r-x48j-fg8p","id":"tcs_01M5KF5WM6WRRCPGYRB0BTJ2ZN","modified_at":"2026-09-08T17:56:07.549343Z","published_at":"2026-06-15T03:30:32Z","references":["https://osv.dev/vulnerability/GHSA-663r-x48j-fg8p","https://nvd.nist.gov/vuln/detail/CVE-2026-12208","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/pull/806","https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159","https://github.com/OriginSecurityX/jsonata-hasownproperty-bypass","https://github.com/jsonata-js/jsonata","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1","https://vuldb.com/cve/CVE-2026-12208","https://vuldb.com/submit/832446","https://vuldb.com/vuln/370850","https://vuldb.com/vuln/370850/cti"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-663r-x48j-fg8p","url":"https://osv.dev/vulnerability/GHSA-663r-x48j-fg8p"}],"summary":"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override"}