CVE-2026-124987

MEDIUM 6.3

mikefarah yq encoder_properties.go Encode escape output

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CWE	CWE-116 CWE-74
Vendor	mikefarah
Product	yq
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for mikefarah yq

Be the first to know when new medium vulnerabilities affecting mikefarah yq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mikefarah / yq

4.53.0 4.53.1 4.53.2 4.53.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/433161 vuldb.com: https://vuldb.com/vuln/433161/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124987 vuldb.com: https://vuldb.com/submit/1040562 github.com: https://github.com/mikefarah/yq/issues/2901 github.com: https://github.com/mikefarah/yq/pull/2902 github.com: https://github.com/mikefarah/yq/

Credits

🔍 carfeii (VulDB User) VulDB CNA Team