UBUNTU-CVE-2026-124987: Medium severity ubuntu/yq vulnerability
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attack requires user interaction. It can be launched remotely and does not require privileges, but the available data does not specify the exact interaction or input path required.
Are systems using the default configuration known to be affected?
The available information does not state whether a default configuration is affected. It identifies the vulnerable function as Encode in pkg/yqlib/encoder_properties.go.
Is a fix available?
A pull request intended to fix the issue is awaiting acceptance. The provided data does not identify a fixed release or an Ubuntu package update.
What is the impact if exploitation succeeds?
Successful exploitation may affect confidentiality, integrity, and availability at a low level. The issue involves escaping of output.