---
id: "CVE-2026-124987"
page: "https://infrastack.ai/live/CVE-2026-124987"
kind: "vulnerability"
aliases: ["CVE-2026-124987"]
title: "yq: properties encoder escapes output incorrectly, enabling remote output manipulation"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "yq", "fixed": [], "affected": "<= 4.53.3", "ecosystem": "go"}]
ecosystems: []
tags: ["ci", "devops", "go", "package", "yq"]
not_affected_if: ["no-properties-output"]
published_at: "2026-11-09T20:18:10+00:00"
first_seen_at: "2026-11-09T20:48:13+00:00"
updated_at: "2026-11-09T20:52:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124987", "first_seen_at": "2026-11-09T20:48:13+00:00"}, {"source": "analyst", "url": "https://github.com/mikefarah/yq/pull/2902", "first_seen_at": "2026-11-09T20:52:20+00:00", "cites": ["https://github.com/mikefarah/yq/pull/2902"]}]
exploit_sources: []
---

# yq: properties encoder escapes output incorrectly, enabling remote output manipulation

Link for people: https://infrastack.ai/live/CVE-2026-124987 (this .md is for agents)

The Encode function in yq's properties encoder (pkg/yqlib/encoder_properties.go) does not escape output correctly, per the NVD description. The sources say a remote attacker can trigger it, but do not state the exact impact beyond output manipulation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:yq affected <= 4.53.3 fixed no fixed version listed

## How to check

- Run `yq --version`; NVD lists versions up to 4.53.3 as affected. Note v4.54.3 was released 2026-11-09, but no source says it fixes this.
- Search scripts and CI for yq calls with -o=props / -o=properties, and for untrusted input feeding them.

## Timeline

- 2026-11-09T20:48:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124987
- 2026-11-09T20:52:20+00:00 analyst https://github.com/mikefarah/yq/pull/2902 — NVD page unreadable via tools (Exa out of credits; WebFetch got no content). Candidate fix PR mikefarah/yq#2902 (open, unmerged; fixes issue #2901 about control/escape chars in properties/csv/tsv/shell encoders) does not mention the CVE, so the link to this CVE is unconfirmed. No fixed version known. Exact impact unverified; nothing marked verified.

## Documents

- [mentions] yq PR #2902: strip ANSI escape and control characters from non-terminal output formats (open) https://github.com/mikefarah/yq/pull/2902

## From the sources

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_