PT-2026-141101

CVE-2026-124987

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 3.1
6.3
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')
CWE-116: Improper Encoding or Escaping of Output
Related identifiers
CVE-2026-124987
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com