CVE-2025-9403: jqlang jq JSON jq_test.c run_jq_tests assertion

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-25 · updated 2026-06-17
Weakness: CWE-617

Description

A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.

Affected products

jqlang jq: through 1.6

References

https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing
https://github.com/jqlang/jq/issues/3393
https://vuldb.com/?ctiid.321239
https://vuldb.com/?id.321239
https://vuldb.com/?submit.633170
https://github.com/jqlang/jq/issues/3393
https://vuldb.com/?submit.633170

Get alerted when CVE-2025-9403 or the next vulnerability affects your stack