{"id":"CVE-2026-124987","kind":"vulnerability","aliases":["CVE-2026-124987"],"related":[],"title":"yq: properties encoder escapes output incorrectly, enabling remote output manipulation","description":"A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.","summary":"The Encode function in yq's properties encoder (pkg/yqlib/encoder_properties.go) does not escape output correctly, per the NVD description. The sources say a remote attacker can trigger it, but do not state the exact impact beyond output manipulation.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"yq","fixed":[],"affected":"<= 4.53.3","ecosystem":"go"}],"ecosystems":[],"tags":["ci","devops","go","package","yq"],"not_affected_if":["no-properties-output"],"how_to_check":"- Run `yq --version`; NVD lists versions up to 4.53.3 as affected. Note v4.54.3 was released 2026-11-09, but no source says it fixes this.\n- Search scripts and CI for yq calls with -o=props / -o=properties, and for untrusted input feeding them.","fix":null,"status":"open","published_at":"2026-11-09T20:18:10+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:39+00:00","updated_at":"2026-11-09T20:52:20+00:00","category":"package","confidence":0.45,"triage":{"at":"2026-11-09T20:49:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"yq: properties encoder escapes output incorrectly, enabling remote output manipulation","impact":"low","summary":"The Encode function in yq's properties encoder (pkg/yqlib/encoder_properties.go) does not escape output correctly, per the NVD description. The sources say a remote attacker can trigger it, but do not state the exact impact beyond output manipulation.","audience":"developers","category":"package","nicknames":[],"who_cares":["yq","go","ci","devops"],"confidence":0.4,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker-controlled data alters encoded output; exact impact unknown","analyst_note":"Confirm the attack vector and impact from the NVD entry and the linked pull request; the sources say the fix PR is still awaiting acceptance, so no fixed version is known.","how_to_check":"- Check the installed yq version with `yq --version`; the sources say versions up to `4.53.3` are affected.\n- Find where yq writes .properties output in scripts or pipelines, since that is the affected encoder.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-properties-output"],"who_is_affected":"Teams that run yq to encode data into Java-style .properties output, particularly where the input comes from untrusted sources. The sources do not say which configurations are exposed beyond the affected Encode function. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4542,"output_tokens":529,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the attack vector and impact from the NVD entry and the linked pull request; the sources say the fix PR is still awaiting acceptance, so no fixed version is known.","search":"'-124987':13A,16A '-2026':12A,15A '4.53.3':70C 'accept':103C 'affect':72C 'attack':46B,93C 'await':102C 'beyond':57B 'ci':18B 'correct':36B 'cve':11A,14A 'descript':40B 'devop':19B 'enabl':7A 'encod':3A,24B,30B,75C 'escap':4A,34B,84C 'exact':55B 'file':78C 'fix':99C 'found':64C 'function':25B,74C 'go':20B 'impact':56B 'incorrect':6A 'issu':101C 'launch':91C 'lead':82C 'manipul':10A,59B,81C 'mikefarah':66C 'nvd':39B 'output':5A,9A,35B,58B,86C 'packag':21B 'per':37B 'pkg/yqlib/encoder_properties.go':31B,79C 'possibl':89C 'properti':2A,29B 'pull':96C 'remot':8A,45B,94C 'request':97C 'say':43B 'sourc':42B 'state':53B 'trigger':48B 'vulner':61C 'yq':1A,17A,22B,27B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams that run mikefarah yq to write .properties output (also CSV/TSV/shell encoders per the related issue) from untrusted input in scripts or CI. NVD says versions up to 4.53.3 are affected and the attack is remote. Teams that never use yq's properties output can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["yq"],"ptokens":["yq"],"labels":["ci","devops","go","high","package","yq"],"campaign_type":null,"search_a":"'-124987':13A,16A '-2026':12A,15A 'cve':11A,14A 'enabl':7A 'encod':3A 'escap':4A 'incorrect':6A 'manipul':10A 'output':5A,9A 'properti':2A 'remot':8A 'yq':1A,17A","search_b":"'attack':46B 'beyond':57B 'ci':18B 'correct':36B 'descript':40B 'devop':19B 'encod':24B,30B 'escap':34B 'exact':55B 'function':25B 'go':20B 'impact':56B 'manipul':59B 'nvd':39B 'output':35B,58B 'packag':21B 'per':37B 'pkg/yqlib/encoder_properties.go':31B 'properti':29B 'remot':45B 'say':43B 'sourc':42B 'state':53B 'trigger':48B 'yq':22B,27B","search_c":"'4.53.3':70C 'accept':103C 'affect':72C 'attack':93C 'await':102C 'encod':75C 'escap':84C 'file':78C 'fix':99C 'found':64C 'function':74C 'issu':101C 'launch':91C 'lead':82C 'manipul':81C 'mikefarah':66C 'output':86C 'pkg/yqlib/encoder_properties.go':79C 'possibl':89C 'pull':96C 'remot':94C 'request':97C 'vulner':61C 'yq':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124987","severity":null,"published_at":"2026-11-09T20:18:10+00:00","modified_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124987:2348","url":"https://github.com/mikefarah/yq/pull/2902","severity":null,"published_at":"2026-11-09T20:52:20+00:00","modified_at":"2026-11-09T20:52:20+00:00","first_seen_at":"2026-11-09T20:52:20+00:00","fetched_at":"2026-11-09T20:52:20+00:00","note":"NVD page unreadable via tools (Exa out of credits; WebFetch got no content). Candidate fix PR mikefarah/yq#2902 (open, unmerged; fixes issue #2901 about control/escape chars in properties/csv/tsv/shell encoders) does not mention the CVE, so the link to this CVE is unconfirmed. No fixed version known. Exact impact unverified; nothing marked verified.","cites":["https://github.com/mikefarah/yq/pull/2902"]}],"documents":[{"id":109840,"url":"https://github.com/mikefarah/yq/pull/2902","title":"yq PR #2902: strip ANSI escape and control characters from non-terminal output formats (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}