CVE-2026-124987
mikefarah yq encoder_properties.go Encode escape output
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Public vulnerability details
- Record state
- Published
- Published (UTC)
- Last updated (UTC)
- Assigned by
- VulDB
- CVSS score
- 5.3 (CVSS v4.0, from VulDB)
- Severity
- MEDIUM
- CISA KEV
- No KEV entry in this record. This does not show that the CVE is absent from the KEV catalog.
- Additional data from
- None
FHE assessment
No FHE assessment is available in this application yet. This does not mean FHE cannot mitigate an impact of this CVE.
References
- VDB-433161 | mikefarah yq encoder_properties.go Encode escape output (VulDB)
- VDB-433161 | CTI Indicators (IOB, IOC, IOA) (VulDB)
- CVE-2026-124987 | CVE Analysis and Report (VulDB)
- Submit #1040562 | https://github.com/mikefarah/ yq <= 4.53.3 Improper Neutralization of Escape, Meta, or Control Sequences (VulDB)
- https://github.com/mikefarah/yq/issues/2901 (VulDB)
- https://github.com/mikefarah/yq/pull/2902 (VulDB)
- https://github.com/mikefarah/yq/ (VulDB)
Source
CVE JSON 5.2 record from the CVE List archive 2026-11-09_delta_CVEs_at_end_of_day.zip, which covers changes through . Imported .