Logo
›
›vulnerability›CVE-2025-9403
Name
CVE-2025-9403
Source
NVD ( link)Debian ( link)
Description
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
CWEs
CWE-617
Published Date
Updated Date
Workaround
-
Advisories
https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharingExploit
https://github.com/jqlang/jq/issues/3393Exploit
https://vuldb.com/?ctiid.321239Permissions Required
https://vuldb.com/?id.321239VDB Entry
https://vuldb.com/?submit.633170Exploit
https://github.com/jqlang/jq/issues/3393Exploit
https://vuldb.com/?submit.633170Exploit

Analysis#

Affected Component
Analysis
jq
Patched

Vulnerability Ratings#

1.9
CVSSv4
3.3
CVSSv31
5.5
CVSSv31
1.7
CVSSv2
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
jq
buildroot
2025.02.x
1.7.1
Not Affected
jq
buildroot
master
1.8.1
Not Affected
jq
openwrt
master
1.8.1-r2
Not Affected
jq
openwrt
openwrt-25.12
1.8.1-r2
Not Affected
jq
yocto
kirkstone
1.6+gitX
Patched
jq
yocto
master
1.8.1
Not Affected

Resolved with patches#

jq (yocto:kirkstone)

#
Title
Author
Resolve
1
Fix expected value assertion for NaN value (fix #3393)
itchyny <itchyny@cybozu.co.jp>
CVE-2025-9403

jq (yocto:scarthgap)

#
Title
Author
Resolve
1
Fix expected value assertion for NaN value (fix #3393)
itchyny <itchyny@cybozu.co.jp>
CVE-2025-9403