Vulnerability · Published Aug 25, 2025 · Assigned by VulDB
CVE-2025-9403jqlang jq JSON jq_test.c run_jq_tests assertion
Low 3.3
In plain English
A low-severity security flaw in jq from jqlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 86.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jq | no fix listed | DEBIAN-CVE-2025-9403 |
| Debian:13 | jq | no fix listed | DEBIAN-CVE-2025-9403 |
| Debian:14 | jq | no fix listed | DEBIAN-CVE-2025-9403 |
| Ubuntu:22.04:LTS | jq | no fix listed | UBUNTU-CVE-2025-9403 |
| Ubuntu:24.04:LTS | jq | no fix listed | UBUNTU-CVE-2025-9403 |
| Ubuntu:25.10 | jq | no fix listed | UBUNTU-CVE-2025-9403 |
| Ubuntu:26.04:LTS | jq | no fix listed | UBUNTU-CVE-2025-9403 |
| Ubuntu:26.10 | jq | no fix listed | UBUNTU-CVE-2025-9403 |
Affected products (as reported)
Weakness: CWE-617 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-321239 | jqlang jq JSON jq_test.c run_jq_tests assertion vdb-entry, technical-description
- VDB-321239 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #633170 | JQ JQ version 1.6 and the newest master. Assertion Failure third-party-advisory
- https://github.com/jqlang/jq/issues/3393 issue-tracking
- https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing exploit