jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but…
GitHub_M·CWE-20·Published 2026-05-11
jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.
jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.
jq es un procesador JSON de línea de comandos. En la versión 1.8.1 y anteriores, jq acepta bytes NUL incrustados en las rutas de importación a nivel del lenguaje jq, pero luego resuelve esas rutas a través de operaciones de cadena de C durante la búsqueda de módulos y archivos de datos. Esto crea una discrepancia entre la cadena de importación lógica que el código de política o auditoría puede validar y la ruta en disco que jq realmente abre.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 4.4 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | Primary | cve.org | 4.4 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | Secondary | NVD | 4.4 | 1.8 | 2.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |