Skip to main content

jq CVE-2026-43895

| EUVDEUVD-2026-29173 MEDIUM
Improper Input Validation (CWE-20)
2026-05-11 GitHub_M
Information Disclosure Red Hat Jq Jqlang
4.4
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
4.4 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
May 11, 2026 - 18:47 vuln.today
CVE Published
May 11, 2026 - 17:24 nvd
MEDIUM 4.4

DescriptionGitHub Advisory

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

AnalysisAI

jq versions 1.8.1 and earlier allow local authenticated users to bypass import path validation through NUL byte injection, enabling access to unintended files and potential information disclosure. An attacker with local access can craft a jq script containing embedded NUL bytes in import paths that pass policy validation checks but resolve to arbitrary files on disk via C string operations, circumventing intended access controls.

Technical ContextAI

jq is a command-line JSON processor that supports module imports and data-file loading via import/include statements. The vulnerability stems from a mismatch between jq's language-level path handling (which accepts NUL bytes as valid characters) and the underlying C string operations used during filesystem resolution. C strings are NUL-terminated, so a path like 'safe/file\x00../../secret' is validated as 'safe/file' at the policy level but resolves to '../../secret' when passed to C functions like open(). This is a classic null-byte truncation attack against policy enforcement mechanisms (CWE-20: Improper Input Validation). The vulnerability affects the module system's ability to enforce access policies on which files jq can load.

RemediationAI

Update jq to the patched version released after 1.8.1 (exact version to be confirmed from GitHub security advisory GHSA-7q7g-mrq3-phxr at https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr). As an immediate compensating control, restrict filesystem permissions to prevent local users from accessing sensitive files that jq might load, enforce SELinux or AppArmor policies to limit jq's file access regardless of path resolution, and audit jq scripts for NUL byte usage (grep for '\x00', '\000', or null bytes in import statements). If jq must process untrusted scripts, run it in a strict chroot or container with minimal filesystem visibility. Note that these controls do not address the root cause but reduce exploitability.

More in Jq

View all
CVE-2024-53427 HIGH POC
8.1 Feb 26

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
CVE-2015-8863 CRITICAL
9.8 May 06

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
CVE-2025-48060 HIGH POC
7.7 May 21

jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
CVE-2016-4074 HIGH POC
7.5 May 06

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
CVE-2023-49355 HIGH POC
7.5 Dec 11

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
CVE-2023-50268 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2023-50246 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2026-32316 HIGH
8.2 Apr 13

Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
CVE-2026-49839 HIGH
7.1

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
CVE-2026-54679 MEDIUM
6.9

jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
CVE-2026-39979 MEDIUM
6.9 Apr 13

Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process ter
CVE-2026-47770 MEDIUM
6.8

jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-43895 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy