YQ · CVE-2026-124987 · Package
NO FIX YET
The Encode function in yq's properties encoder (pkg/yqlib/encoder_properties.go) does not escape output correctly, per the NVD description. The sources say a remote attacker can trigger it, but do not state the exact impact beyond output manipulation.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run mikefarah yq to write .properties output (also CSV/TSV/shell encoders per the related issue) from untrusted input in scripts or CI. NVD says versions up to 4.53.3 are affected and the attack is remote. Teams that never use yq's properties output can skip it.
Not affected if no-properties-output
Who cares ci, devops, go, yq
yq --version; NVD lists versions up to 4.53.3 as affected. Note v4.54.3 was released 2026-11-09, but no source says it fixes this.Unknown from the sources.
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.