The jq command-line JSON processor (version 1.8.1 and earlier) improperly validates input by accepting embedded NUL bytes in import paths at the jq-language level. However, when resolving these paths for module and data-file lookup, jq uses C string operations that treat NUL bytes as string terminators. This discrepancy creates a mismatch between the logical import string validated by policy or audit code and the actual on-disk path accessed by jq, potentially allowing unintended file access.

This vulnerability could allow an attacker with local access and limited privileges to cause jq to open files different from those intended by the import path validation logic. This may lead to information disclosure or other unintended behavior due to the mismatch in path resolution. The impact is limited to confidentiality and integrity with no known impact on availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when processing untrusted input with jq versions 1.8.1 and earlier, especially in environments where import path validation is critical. Monitoring vendor channels for updates is recommended.