jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first…
GitHub_M·CWE-158·Published 2026-05-11
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
jq es un procesador JSON de línea de comandos. En la versión 1.8.1 y anteriores, los programas jq de nivel superior cargados desde un archivo con -f se truncan en el primer byte NUL incrustado en la HEAD actual del repositorio principal. Un archivo de filtro manipulado, como . seguido de \x00 y un sufijo arbitrario, se compila y ejecuta como solo el prefijo antes del NUL. Esto deja a jq con una discrepancia entre el prefijo y el búfer completo posterior a CVE-2026-33948 en la ruta de compilación, a pesar de que la ruta del analizador JSON ya ha sido corregida.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 5.5 | — | — | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| 3.1 | Primary | cve.org | 5.5 | — | — | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| 3.1 | Secondary | ENISA EUVD | 5.5 | — | — | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| 3.1 | Secondary | NVD | 5.5 | 1.8 | 3.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |