{"action":"Upgrade jsonata to 1.8.7 or later.","affected":[{"fixed":"1.8.7","introduced":"1.4.0"},{"fixed":"2.0.4","introduced":"2.0.0"}],"component":"jsonata","cve_ids":["CVE-2024-27307"],"ecosystem":"npm","epss":0.01422,"exploited":false,"fixed_versions":["1.8.7","2.0.4"],"ghsa_id":"GHSA-fqg8-vfv7-8fj8","id":"tcs_01M5KFP2J29XARQTG2RS3MM1ZH","modified_at":"2026-09-10T03:50:10.429369450Z","published_at":"2024-03-04T20:43:12Z","references":["https://osv.dev/vulnerability/GHSA-fqg8-vfv7-8fj8","https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8","https://nvd.nist.gov/vuln/detail/CVE-2024-27307","https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1","https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c","https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2","https://github.com/jsonata-js/jsonata","https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fqg8-vfv7-8fj8","url":"https://osv.dev/vulnerability/GHSA-fqg8-vfv7-8fj8"}],"summary":"JSONata expression can pollute the \"Object\" prototype"}