CVE-2026-124987
mikefarah yq encoder_properties.go Encode escape output
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
CVSS 4.0 · 5.3 Medium
EPSS < 1%
KEV · Not listed
Vendors
Products