Three critical JSONata vulnerabilities let crafted expressions escape into Node.js code execution. The PoCs are public, but exploitation requires control of the expression, not ordinary JSON data.