VulnerabilityAnalyzed
CVE-2025-9403
A vulnerability was determined in jqlang jq up to 1.6.
LOW 1.9EPSS 0.21%
Does this matter?
Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
- CVSS 4.0
- 1.9 LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.21% probability · 11th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-617
- Affected
- jqlang/jq
- Source
- cna@vuldb.com
References
- https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharingExploit
- https://github.com/jqlang/jq/issues/3393Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.321239Permissions Required, VDB Entry
- https://vuldb.com/?id.321239Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.633170Exploit, Third Party Advisory, VDB Entry
- https://github.com/jqlang/jq/issues/3393Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?submit.633170Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.