Description
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mikefarah | yq | 4.53.0, 4.53.1, 4.53.2, 4.53.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | yq | No fix yet | — |
| Ubuntu 26.04 LTS | yq | No fix yet | — |
| Ubuntu 24.04 LTS | yq | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | yq | No fix yet | — |
References
- VDB-433161 | mikefarah yq encoder_properties.go Encode escape output vdb-entry technical-description
- VDB-433161 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-124987 | CVE Analysis and Report third-party-advisory
- Submit #1040562 | https://github.com/mikefarah/ yq <= 4.53.3 Improper Neutralization of Escape, Meta, or Control Sequences third-party-advisory
- https://github.com/mikefarah/yq/issues/2901 issue-tracking
- https://github.com/mikefarah/yq/pull/2902 issue-tracking patch
- https://github.com/mikefarah/yq/ product