NUL Byte Truncation Issue in jq Command-Line JSON Processor by JQLang

CVE-2026-41256

What is CVE-2026-41256?

The jq command-line JSON processor, versions 1.8.1 and earlier, is susceptible to a NUL byte truncation vulnerability when loading top-level programs from a file using the -f option. This vulnerability allows a specially crafted filter file to compile and execute a prefix before the NUL byte, leading to unexpected behavior and potential execution of arbitrary code. This occurs due to a mismatch in the compilation process, despite improvements in the JSON parser path. Users are advised to update to a secure version to mitigate risks associated with this issue.

References