CVE-2026-124987: mikefarah yq encoder_properties.go Encode escape output
Published Nov 9, 2026
·Updated
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected Software
1 affected component
mikefarah yq<=4.53.3
Event History
Nov 9, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
mikefarah yq versions up to 4.53.3 are identified as affected. The issue is in the Encode function in pkg/yqlib/encoder_properties.go.
2
What does an attacker need to exploit this issue?
The issue can be launched remotely and has low attack complexity. It does not require privileges, but it does require user interaction.
3
Is a fix available?
A pull request to fix the issue exists, but it is awaiting acceptance. No accepted fixed release is identified in the available information.