The jq command-line JSON processor before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b improperly handles embedded NUL bytes in input. It uses strlen() to determine buffer length when reading JSON from files or stdin, truncating input at the first NUL byte and validating only the prefix as JSON. This enables validation bypass where malicious trailing data after the NUL byte is ignored by jq but may be processed by downstream consumers, leading to parser differential attacks. The issue is tracked as CVE-2026-33948 and has been fixed by the referenced commit.

The vulnerability allows an attacker to bypass jq's JSON validation by embedding NUL bytes, causing jq to validate only a benign prefix of the input. Downstream consumers that process the full input including the ignored trailing data may be exposed to malicious content, potentially leading to security issues in workflows relying on jq for JSON validation. The CVSS score is low (2.9), indicating limited impact and exploitability.

This vulnerability has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b. Users should upgrade jq to a version that includes this fix. No other mitigation is indicated by the vendor advisory. Patch status is not explicitly stated beyond the commit, so verify the vendor's latest releases for the fix.