The jq command-line JSON processor had a vulnerability (CVE-2026-33948) in versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b where it used strlen() to determine the length of JSON input read via fgets(). This caused jq to truncate input at the first embedded NUL byte, validating only the prefix of the JSON input and ignoring any trailing data after the NUL byte. Attackers could craft inputs with a benign JSON prefix followed by malicious trailing data after a NUL byte, bypassing jq's validation. This could lead to parser differential attacks where downstream consumers process the full malicious input, despite jq's validation passing. The issue is addressed by the mentioned commit, which corrects input length handling.

The vulnerability allows attackers to bypass jq's JSON validation by embedding NUL bytes, causing jq to ignore trailing malicious data. This can lead to downstream consumers processing unvalidated, potentially malicious JSON data. However, the impact is limited by the low CVSS score (2.9) and the requirement that downstream consumers process the full input including the ignored suffix. There are no known exploits in the wild.

This vulnerability has been fixed by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b. Users should upgrade jq to a version that includes this commit or later. Patch status is not explicitly stated beyond the commit, so verify the vendor's latest releases for the fix. No additional mitigation is required if the patched version is used.