CVE-2026-43895 describes an improper input validation vulnerability in jq (versions <=1.8.1) where embedded NUL bytes in import paths are accepted by the jq language parser but truncated during file path resolution due to C string handling. This mismatch allows an attacker to cause jq to access files different from those intended by the validated import string, potentially leading to unintended file access. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.4. There is no confirmed official patch or remediation available as of the published date.

The vulnerability can result in unintended file access due to the mismatch between the import path validation and actual file path resolution. This may allow an attacker with local privileges to cause jq to read files other than those intended, potentially exposing sensitive information. The impact is limited to confidentiality and integrity with no availability impact. Exploits in the wild are not known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when processing untrusted import paths with jq versions 1.8.1 and earlier. Consider restricting jq usage to trusted inputs or environments.