The flaw lies in the Encode function of mikefarah yq versions up to 4.53.3, where certain characters are not correctly escaped in the generated output. A malicious actor can craft input that causes the produced YAML to contain unintended sequences. If the output is then consumed by downstream tools that interpret these sequences, it could trigger the execution of injected commands. The likely impact is therefore the potential for remote code execution, inferred from the description that downstream applications might interpret the malformed output.

This vulnerability affects installations of mikefarah yq through version 4.53.3 inclusive. Versions 4.53.4 and newer contain the fix and are not impacted.

The CVSS score of 5.3 indicates moderate severity. No exploit data is currently available and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified. Remote exploitation requires only the submission of crafted input to yq, but the absence of active exploits and the medium severity suggest a moderate risk that warrants applying a remedy as soon as possible.