jsonata src/functions.js lookup lacks Object.prototype.hasOwnProperty, letting attacker-supplied JSONata expressions access inherited prototype members and reach child_process via process.getBuiltinModule. Remote, no-auth/no-UI exploitation can lead to arbitrary code execution with host process privileges. Upgrade to 1.8.8 or 2.2.0 (or later).