CVE-2026-77414
CriticalAdvisory
Published 21 Aug 2026In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.3
- base score, highest
- EPSS
- 0.004
- 36th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 19
- of 17,781 indexed, latest versions
- Container images
- 17
- deployed by those charts
- Fix available
- 1 of 1
- affected package
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 17 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jsonatanpm | 1.5.4, 1.8.6, 2.0.4, 2.0.5+3 more | 1.8.8, 2.2.1 | 17 |
- OSV records
- GHSA-2943-5xfg-gq5f
Charts affected
19 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 30,159 |
| node-rednode-redVerified publisher | 0.40.2 | 1 of 1See more | 2,172 |
| uptimekumahelm-l3st86Verified publisher | 0.1.10 | 1 of 1See more | 4,196 |
| uptime-kumapascaliskeVerified publisher | 3.0.0 | 1 of 1See more | 6,883 |
| uptime-kumasb-helm-charts | 0.4.0 | 1 of 1See more | 38,107 |
| node-redcloudnativeapp | 1.2.2 | 1 of 1See more | 4,790 |
| uptime-kumadjjudas21Verified publisher | 1.5.18 | 1 of 1See more | 4,217 |
| node-redegebackVerified publisher | 2.0.13 | 1 of 1See more | 975 |
| uptime-kumaegebackVerified publisher | 2.0.12 | 1 of 1See more | 30,159 |
| uptime-kumafluent-operatorVerified publisher | 0.1.0 | 1 of 1See more | 3,474 |
| node-redgeek-cookbookVerified publisher | 10.3.2 | 1 of 1See more | 2,102 |
| uptime-kumahelmforgeVerified publisher | 1.5.12 | 1 of 1See more | 30,099 |
| uptime-kumakubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 6,356 |
| uptime-kumalbenicio-communityVerified publisher | 0.1.1 | 1 of 1See more | 33,242 |
| node-redlmatfyVerified publisher | 0.1.6 | 1 of 1See more | 1,809 |
| uptime-kumaloeken-at-homeVerified publisher | 2.3.2 | 1 of 1See more | 33,242 |
| uptime-kumarubxkubeVerified publisher | 1.2.1 | 1 of 1See more | 30,219 |
| node-redth0ths-helm-charts | 0.2.1 | 1 of 2See more | 2,408 |
| node-redthl-chartsVerified publisher | 0.1.0 | 1 of 1See more | 2,806 |
Container images carrying it
17 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| louislam/ | 9aeb4e51d038 | jsonata | 2.2.1 | 2 |
| louislam/ | a8610b3b4c38 | jsonata | 2.2.1 | 2 |
| louislam/ | 059b49d64739 | jsonata | 2.2.1 | 1 |
| louislam/ | 3d632903e6af | jsonata | 2.2.1 | 1 |
| louislam/ | 3e24e96c89ef | jsonata | 2.2.1 | 1 |
| louislam/ | 4c364ef96aad | jsonata | 2.2.1 | 1 |
| louislam/ | 91e963bfda56 | jsonata | 2.2.1 | 1 |
| louislam/ | 96510915e6be | jsonata | 2.2.1 | 1 |
| louislam/ | 9865163f92c1 | jsonata | 2.2.1 | 1 |
| louislam/ | bc6f244ecf27 | jsonata | 2.2.1 | 1 |
| nodered/ | 10f40d0a83e7 | jsonata | 2.2.1 | 1 |
| nodered/ | 216e7403aab9 | jsonata | 2.2.1 | 1 |
| nodered/ | d73ae167cb9b | jsonata | 2.2.1 | 1 |
| nodered/ | e131dcadfe92 | jsonata | 1.8.8 | 1 |
| nodered/ | e2632a7a35dd | jsonata | 1.8.8 | 1 |
| nodered/ | 070643219ea2 | jsonata | 1.8.8 | 1 |
| th0th/ | d06fa39f7406 | jsonata | 2.2.1 | 1 |