JSON Processor Vulnerability in jq Affects Command-Line Parsing

CVE-2026-33948

What is CVE-2026-33948?

The jq command-line JSON processor experiences a vulnerability that allows for input validation bypass due to faulty command-line input parsing. Specifically, versions prior to a certain commit truncate input at the first embedded NUL byte, leading to potential parser differential attacks. Attackers can exploit this flaw by providing a benign JSON prefix followed by malicious data, enabling valid JSON validation while disregarding harmful subsequent content. This vulnerability creates risks in workflows that rely on jq, as malicious input can be passed to downstream systems that may not perform adequate validation, heightening the risk of data processing issues and security breaches.

References