CVEvulnerability

CVE-2026-43895

4.4 MEDIUM Published 2026-05-11 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-11
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-158, CWE-20

Description

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

Affected configurations

• jqlang jq (<= 1.8.1)

Related

Weakness · CWE (2)

  • CWE-158 Improper Neutralization of Null Byte or NUL Character weakness
  • CWE-20 Improper Input Validation weakness

References