Improper Output Escaping in Mikefarah YQ Software
CVE-2026-124987

5.3MEDIUM

Key Information:

Vendor

Mikefarah

Status
Yq
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124987?

A vulnerability exists within the Mikefarah YQ software, specifically in the Encode function of the encoder_properties.go file, impacting versions up to 4.53.3. This flaw allows for the improper escaping of output, potentially enabling remote attacks. A pull request to address this issue is currently pending acceptance, emphasizing the urgency for users to stay informed about the risks and implement the necessary patches as they become available.

Affected Version(s)

yq 4.53.0

yq 4.53.1

yq 4.53.2

References

https://vuldb.com/vuln/433161
vdb-entrytechnical-description
https://vuldb.com/vuln/433161/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124987
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

carfeii (VulDB User)
VulDB CNA Team
.