CVE-2026-124987 | mikefarah yq up to 4.53.3 encoder_properties.go Encode escape output (Issue 2901)

November 9, 2026 Yanac

A vulnerability classified as critical was found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output.

This vulnerability is referenced as CVE-2026-124987. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More