jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 Exploit, Mitigation, Vendor Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.4 · jqlangNVD modified 2026-10-26 18:10
Affected (CPE criteria) 1
cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*
References 2
- https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 Exploit, Mitigation, Vendor Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 Exploit, Mitigation, Vendor Advisory