Skip to main content
CVE-2024-45338VulnerabilityPublished Updated

SUSE · Security update for yq

Affects SUSESource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch SUSE soon.

Data as of 10 Nov 2026, 20:06 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 4.53.2

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 2 Jun 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for yq fixes the following issues: Changes in yq: - Fix multiple CVEs: * CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199) - update to v4.53.2 * Add system(command; args) operator (disabled by default). * TOML encoder: prefer readable table sections over inline tables. * Fix TOML encoder to quote keys containing special characters. * Add string slicing support. * Fix findInArray misuse on MappingNodes in equality and contains. * Fix panic on negative slice indices that underflow after adjustment. * Fix stack overflow from circular alias in traverse. * Fix panic and OOM in repeatString for large repeat counts. - update to v4.52.5 * Fix: reset TOML decoder state between files. * Fix: preserve original filename when using --front-matter. - Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`). - Fix CVE-2026-33814 (bsc#1266248): * update golang.org/x/net to v0.53.0. - update to 4.52.4: * Dropping windows/arm - no longer supported in cross-compile * Fixing comments in TOML arrays * Bumped dependencies - update to 4.52.2: * Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst * Fixed TOML table scope after comments (#2588) Thanks @tomers * Multiply uses a readonly context * Fixed merge globbing wildcards in keys * Fixing TOML subarray parsing issue - update to 4.52.1: * TOML encoder support - you can now roundtrip! #1364 * Parent now supports negative indices, and added a 'root' command for referencing the top level document * Fixed scalar encoding for HCL * Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal * Add symlink check to file rename util (#2576) Thanks @Elias- elastisys * Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded * Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters * Added K8S KYAML output format support (#2560) Thanks @robbat2 - update to 4.50.1: * Added HCL Support - First cut - hopefully it works well! * Fixing handling of CRLF #2352 - update to 4.49.2: * Fixing escape character bugs :sweat: #2517 * Fixing snap release pipeline #2518 Thanks @aalexjo - update to 4.49.1: * Added `--security` flags to disable env and file ops #2515 * Fixing TOML ArrayTable parsing issues #1758 * Fixing parsing of escaped characters #2506 - update to 4.48.2: * Strip whitespace when decoding base64 #2507 * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet) * Add linux/loong64 to release target (thanks @znley) * Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx) - update to 4.48.1: * Added 'parents' operator, to return a list of all the hierarchical parents of a node * Added 'first(exp)' operator, to return the first entry matching an expression in an array * Fixed xml namespace prefixes #1730 (thanks @baodrate) * Fixed out of range panic in yaml decoder #2460 (thanks @n471d) * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0. - update to 4.47.2: * Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis) - update to 4.47.1: * Fixed merge anchor behaviour (`<<`); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv! - Fix zsh completion location - update to 4.46.1: * Added INI support * Fixed 'add' operator when piped in with no data #2378, #2383, #2384 * Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes * Fixed yq small build Thanks @imzue * Switched to YAML org supported go-yaml! - update to 4.45.4: * Fixing wrong map() behaviour on empty map #2359 - update to 4.45.3: * Fixing regression (#2353, #2359, #2325) introduced with in 4.45.2 with #2325 fix - update to 4.45.2: * Added windows arm builds (Thanks @albertocavalcante, @ShukantPal) * Added s390x platform support (Thanks @ashokpariya0) * Additionally push docker images to ghcr.io (Thanks @reegnz) * Fixing add when there is no node match #2325 * sort_by works on maps * Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by updating golang.org/x/net to 0.39.0. - update to 4.45.1: * Create parent directories when --split-exp is used, Thanks @rudo-thomas - Updated to 4.44.6: * Fixed deleting items in array bug #2027, #2172; Thanks @jandubois * Docker image for armv7 / raspberry pi3, Thanks @brianegge * Fixed no-colors regression #2218 * Fixed various panic scenarios #2211 * Bumped dependencies - Changes from 4.44.5 (4.44.4 was skipped) * Format comments with a gray foreground (Thanks @gabe565)

References

Community reviews

Loading reviews…