CVE-2026-43895

jq processes JSON through user supplied import paths. In releases 1.8.1 and earlier, the jq language accepts embedded NUL bytes in these paths, but when the runtime resolves the paths it uses C string operations that truncate at the first NUL. This creates a mismatch between the logical path that policy or audit code may validate and the actual on‑disk path that jq opens. As a result, a locally executing actor can include a NUL byte in an import path to force jq to open a different file than the one the policy permits, thereby bypassing redaction rules and preserving sensitive fields in any artifacts produced by the command.

The vulnerability is present in the jq JSON processor from the jqlang:jq project. Versions 1.8.1 and all earlier releases are affected; a newer release that corrects the NUL handling is required.

With a CVSS score of 4.4 the vulnerability is considered moderate. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but it can be exploited locally by constructing a jq command or script that contains an embedded NUL byte in an import path. The attacker must have the ability to run jq on the target system; no network‑based trigger is described, so the attack surface is confined to local execution or automated build pipelines that invoke jq.