CVE-2026-124987
Deferred Deferred - Pending Action

YQ Output Escaping Vulnerability in yq

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulDB

Description
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-10
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124987
EUVD
EUVD-2026-120397

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mikefarah yq 4.53.0
mikefarah yq 4.53.1
mikefarah yq 4.53.2
mikefarah yq 4.53.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the mikefarah yq tool up to version 4.53.3. It is located in the Encode function of the file pkg/yqlib/encoder_properties.go. The issue allows for output escaping, which could enable remote attacks. A fix has been proposed via a pull request but is pending acceptance.

Detection Guidance

To detect this vulnerability, check if you are using yq version up to 4.53.3. Run `yq --version` to verify. Inspect if your system processes untrusted YAML, CSV, TSV, properties, or shell variable files with yq. Look for unexpected terminal behavior or output corruption when using these formats.

Impact Analysis

The vulnerability could allow attackers to manipulate output data, potentially leading to unauthorized access or data leaks. Since it can be exploited remotely, users of affected versions should update to a patched version as soon as possible.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it primarily involves unintended output of control characters in non-terminal formats. However, if exploited to inject malicious terminal commands, it could indirectly lead to unauthorized data access or manipulation, potentially violating confidentiality requirements under GDPR or HIPAA.

Mitigation Strategies

Update yq to a version beyond 4.53.3 where the pull request fixing this issue has been accepted. Avoid using vulnerable versions for processing untrusted input to prevent output escaping attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...