CVE-2026-43895

A flaw was found in jq, a command line JSON processor. Embedded NUL bytes in import paths are truncated during module and data-file lookup, creating a mismatch between the intended import string and the actual file path opened. This issue allows an attacker who can supply a crafted script to access unintended files.

To exploit this flaw, an attacker needs to supply a crafted script containing embedded NUL bytes in import paths to be processed by jq. This allows the attacker to bypass intended path validation mechanisms and access unintended files. Due to these reasons, this issue has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted scripts with the jq command line JSON processor.