jq versions 1.8.1 and earlier improperly handle embedded null (NUL) bytes in filter files loaded with the -f option. When a filter file contains a NUL byte, jq truncates the program at that byte, causing the compiled filter to only include the prefix before the NUL. This leads to a mismatch between the prefix and the full buffer during compilation, a problem that remains even after fixing a related issue in the JSON parser path (CVE-2026-33948). The vulnerability is classified under CWE-158 (Improper Neutralization of Null Byte or NUL Character) and has a CVSS 3.1 score of 5.5, indicating medium severity. No official patch or remediation level has been published yet.

The vulnerability allows a crafted filter file containing a null byte to cause jq to execute only the prefix before the null byte, potentially leading to unexpected behavior or logic bypass in jq filter execution. The CVSS vector indicates local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, but high integrity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted jq filter files containing embedded null bytes and consider restricting file sources or validating filter files to prevent null byte injection.