jq, a command‑line JSON processor, previously used strlen() instead of the actual byte count from fgets() when reading JSON from files or standard input. This caused the program to truncate data at the first NUL byte and parse only the preceding prefix. An attacker can therefore craft input that begins with a benign JSON string, inserts a NUL byte, and appends malicious trailing data. The truncated portion is silently discarded, so jq accepts the input as valid JSON, but downstream consumers that read the full data will still process the malicious suffix. This vulnerability permits a parser differential attack that can bypass validation logic but still exploit downstream services.

The affected vendor is jqlang and the product is jq. All jq releases before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are vulnerable. No specific product version numbers are provided; any pre‑commit revision of jq is at risk.

The CVSS score for this issue is 2.9, indicating low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying it is not actively exploited at large scale. The likely attack vector is local: any user who can execute jq with crafted input can trigger the vulnerability. Because the flaw requires only a malicious JSON payload passed to jq, exploitation is straightforward for an attacker who can influence input to jq, such as in scripts, CI pipelines, or user‑supplied files.