CVE-2026-12208

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-94CWE-1321

Affected software

VendorProductVersions
jsonata-jsjsonata2.0; 2.1; 2.2.0

References

Timeline

Published
Jun 15, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1220856.5The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-CVE-2026-1220873.7The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to viCVE-2026-122095.3A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/fiCVE-2026-1220957.6AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticCVE-2026-122096Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted CVE-2026-1220976.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-1220985.1CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1220992.9CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker CVE-2026-12219.8PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated rCVE-2026-122106.3A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gqCVE-2026-1221005.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feaCVE-2026-1221013.7CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke