CVE-2026-44777
jq is a command-line JSON processor.
Published May 11, 2026 · updated Jun 17, 2026 · jqlang jq
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · NIST NVD
Detected
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Jun 17, 2026 · NIST NVD
Updated
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Affected
- cpe jqlang/jqversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-44777
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-44777
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
nvd.nist.gov