Orta CVSS 5.5 PoC var
CVE-2026-41256: Jq: güvenlik açığı
Açıklama (NVD)
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
Özet bilgiler
- Ürün
- Jqlang Jq
- CVSS v3.1
- 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS
- %0,16 (yüzdelik 5)
- CWE
- CWE-158
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| jqlang-jq | — | 1.8.1 | — |