Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
89
security advisoryfedoracross site scriptingFedora 43 yq Important Cross-Site Scripting Vuln 2026-990cdd8329
Update to 4.53.3. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-990cdd8329 2026-07-18 00:27:50.464596+00:00 -------------------------------------------------------------------------------- Name : yq Product : Fedora 43 Version : 4.53.3 Release : 1.fc43 URL : https://github.com/mikefarah/yq Summary : Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor Description : Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor. -------------------------------------------------------------------------------- Update Information: Update to 4.53.3 -------------------------------------------------------------------------------- ChangeLog: * Tue Jul 14 2026 Mikel Olasagasti Uranga - 4.53.3-1 - Update to 4.53.3 and add packit integration * Tue Feb 3 2026 Maxwell G - 4.47.1-5 - Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26 * Sat Jan 17 2026 Fedora Release Engineering - 4.47.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Oct 10 2025 Alejandro Sáez - 4.47.1-3 - rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2495328 - CVE-2026-25681 yq: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2495328 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-990cdd8329' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Update for Fedora 43 addresses important security issue in yq, fixing potential cross-site scripting vulnerabilities.. fedora update,yq security,arbitrary code execution,yq bug fix,cross-site scripting. . Severity: Important. LinuxSecurity.com Team
Jul 17, 2026
•Important
Fedora
89
security advisoryfedoraupdateFedora 44 yq Critical Arbitrary Code Execution Fix 2026-710adfa806
Update to 4.53.3. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-710adfa806 2026-07-18 00:26:14.273055+00:00 -------------------------------------------------------------------------------- Name : yq Product : Fedora 44 Version : 4.53.3 Release : 1.fc44 URL : https://github.com/mikefarah/yq Summary : Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor Description : Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor. -------------------------------------------------------------------------------- Update Information: Update to 4.53.3 -------------------------------------------------------------------------------- ChangeLog: * Tue Jul 14 2026 Mikel Olasagasti Uranga - 4.53.3-1 - Update to 4.53.3 and add packit integration -------------------------------------------------------------------------------- References: [ 1 ] Bug #2495328 - CVE-2026-25681 yq: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2495328 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-710adfa806' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 17, 2026
•Important
Fedora
202
security advisoryhtml parsingprivilege escalationopenSUSE Leap 15.5 yq Critical Parsing and Escalation Issues Advisory
An update that solves six vulnerabilities can now be installed.. # Security update for yq Announcement ID: SUSE-SU-2026:2285-1 Release Date: 2026-06-05T12:16:32Z Rating: important References: * bsc#1267053 * bsc#1267199 Cross-References: * CVE-2026-25680 * CVE-2026-25681 * CVE-2026-27136 * CVE-2026-39821 * CVE-2026-42502 * CVE-2026-42506 CVSS scores: * CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25680 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-25681 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N * CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42502 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE LinuxEnterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves six vulnerabilities can now be installed. ## Description: This update for yq fixes the following issues: * CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267053). * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1267199). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-2285=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2285=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * yq-4.53.2-150500.3.9.1 * yq-debuginfo-4.53.2-150500.3.9.1 * openSUSE Leap 15.5 (noarch) * yq-fish-completion-4.53.2-150500.3.9.1 * yq-zsh-completion-4.53.2-150500.3.9.1 * yq-bash-completion-4.53.2-150500.3.9.1 * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64) * yq-4.53.2-150500.3.9.1 * yq-debuginfo-4.53.2-150500.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25680.html * https://www.suse.com/security/cve/CVE-2026-25681.html * https://www.suse.com/security/cve/CVE-2026-27136.html * https://www.suse.com/security/cve/CVE-2026-39821.html * https://www.suse.com/security/cve/CVE-2026-42502.html * https://www.suse.com/security/cve/CVE-2026-42506.html * https://bugzilla.suse.com/show_bug.cgi?id=1267053 * https://bugzilla.suse.com/show_bug.cgi?id=1267199 . Update for yq resolves six important vulnerabilities enhancing system security and functionality..openSUSE yq update vulnerabilities security advisory. . Severity: Important. LinuxSecurity.com Team
Jun 05, 2026
•Important
OpenSUSE
100
security advisoryhtml parsingprivilege escalationopenSUSE Security Advisory 2026-2285-1 yq Important HTML Parsing Issues
An update that solves six vulnerabilities can now be installed.. # Security update for yq Announcement ID: SUSE-SU-2026:2285-1 Release Date: 2026-06-05T12:16:32Z Rating: important References: * bsc#1267053 * bsc#1267199 Cross-References: * CVE-2026-25680 * CVE-2026-25681 * CVE-2026-27136 * CVE-2026-39821 * CVE-2026-42502 * CVE-2026-42506 CVSS scores: * CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25680 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-25681 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N * CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42502 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE LinuxEnterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves six vulnerabilities can now be installed. ## Description: This update for yq fixes the following issues: * CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267053). * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1267199). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-2285=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2285=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * yq-4.53.2-150500.3.9.1 * yq-debuginfo-4.53.2-150500.3.9.1 * openSUSE Leap 15.5 (noarch) * yq-fish-completion-4.53.2-150500.3.9.1 * yq-zsh-completion-4.53.2-150500.3.9.1 * yq-bash-completion-4.53.2-150500.3.9.1 * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64) * yq-4.53.2-150500.3.9.1 * yq-debuginfo-4.53.2-150500.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25680.html * https://www.suse.com/security/cve/CVE-2026-25681.html * https://www.suse.com/security/cve/CVE-2026-27136.html * https://www.suse.com/security/cve/CVE-2026-39821.html * https://www.suse.com/security/cve/CVE-2026-42502.html * https://www.suse.com/security/cve/CVE-2026-42506.html * https://bugzilla.suse.com/show_bug.cgi?id=1267053 * https://bugzilla.suse.com/show_bug.cgi?id=1267199 . SUSE has released an important security update for yq addressing six issues including privilegeescalation risks.. SUSE Linux,yq security update,openSUSE vulnerabilities,security patches,important updates. . Severity: Important. LinuxSecurity.com Team
Jun 05, 2026
•Important
SuSE
202
security advisorybug fiximportantopenSUSE yq Important System Update Fixes Multiple Issues 2026-20892-1
An update that solves 11 vulnerabilities and has 6 bug fixes can now be installed.. openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20892-1 Rating: important References: * bsc#1241719 * bsc#1251339 * bsc#1251540 * bsc#1266248 * bsc#1267053 * bsc#1267199 Cross-References: * CVE-2024-45338 * CVE-2025-22872 * CVE-2025-47911 * CVE-2025-58190 * CVE-2026-25680 * CVE-2026-25681 * CVE-2026-27136 * CVE-2026-33814 * CVE-2026-39821 * CVE-2026-42502 * CVE-2026-42506 CVSS scores: * CVE-2024-45338 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45338 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L * CVE-2025-22872 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L * CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-47911 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58190 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-39821 ( SUSE ): 9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 11 vulnerabilities and has 6 bug fixes can now be installed. Description: This update for yq fixes the following issues: Changes in yq: - Fix multiple CVEs: * CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199) - update to v4.53.2 * Add system(command; args) operator (disabled by default). * TOML encoder: prefer readable table sections over inline tables. * Fix TOML encoder to quote keys containing special characters. * Add string slicing support. * Fix findInArray misuse on MappingNodes in equality and contains. * Fix panic on negative slice indices that underflow after adjustment. * Fix stack overflow from circular alias in traverse. * Fix panic and OOM in repeatString for large repeat counts. - update to v4.52.5 * Fix: reset TOML decoder state between files. * Fix: preserve original filename when using --front-matter. - Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`). - Fix CVE-2026-33814 (bsc#1266248): * update golang.org/x/net to v0.53.0. - update to 4.52.4: * Dropping windows/arm - no longer supported in cross-compile * Fixing comments in TOML arrays * Bumped dependencies - update to 4.52.2: * Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst * Fixed TOML table scope after comments(#2588) Thanks @tomers * Multiply uses a readonly context * Fixed merge globbing wildcards in keys * Fixing TOML subarray parsing issue - update to 4.52.1: * TOML encoder support - you can now roundtrip! #1364 * Parent now supports negative indices, and added a 'root' command for referencing the top level document * Fixed scalar encoding for HCL * Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal * Add symlink check to file rename util (#2576) Thanks @Elias- elastisys * Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded * Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters * Added K8S KYAML output format support (#2560) Thanks @robbat2 - update to 4.50.1: * Added HCL Support - First cut - hopefully it works well! * Fixing handling of CRLF #2352 - update to 4.49.2: * Fixing escape character bugs :sweat: #2517 * Fixing snap release pipeline #2518 Thanks @aalexjo - update to 4.49.1: * Added `--security` flags to disable env and file ops #2515 * Fixing TOML ArrayTable parsing issues #1758 * Fixing parsing of escaped characters #2506 - update to 4.48.2: * Strip whitespace when decoding base64 #2507 * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet) * Add linux/loong64 to release target (thanks @znley) * Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx) - update to 4.48.1: * Added 'parents' operator, to return a list of all the hierarchical parents of a node * Added 'first(exp)' operator, to return the first entry matching an expression in an array * Fixed xml namespace prefixes #1730 (thanks @baodrate) * Fixed out of range panic in yaml decoder #2460 (thanks @n471d) * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0. - update to 4.47.2: * Conversion from TOML to JSON nolonger omits empty tables #2459 (thanks @louislouislouislouis) - update to 4.47.1: * Fixed merge anchor behaviour (`
Jun 03, 2026
•Important
OpenSUSE
202
security advisoryupdatevulnerabilityopenSUSE yq Important Multiple Vulnerabilities Fix 2026-20892-1
An update that solves 11 vulnerabilities and has 6 bug fixes can now be installed.. openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20892-1 Rating: important References: * bsc#1241719 * bsc#1251339 * bsc#1251540 * bsc#1266248 * bsc#1267053 * bsc#1267199 Cross-References: * CVE-2024-45338 * CVE-2025-22872 * CVE-2025-47911 * CVE-2025-58190 * CVE-2026-25680 * CVE-2026-25681 * CVE-2026-27136 * CVE-2026-33814 * CVE-2026-39821 * CVE-2026-42502 * CVE-2026-42506 CVSS scores: * CVE-2024-45338 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45338 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L * CVE-2025-22872 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L * CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-47911 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-58190 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-39821 ( SUSE ): 9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 11 vulnerabilities and has 6 bug fixes can now be installed. Description: This update for yq fixes the following issues: Changes in yq: - Fix multiple CVEs: * CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199) - update to v4.53.2 * Add system(command; args) operator (disabled by default). * TOML encoder: prefer readable table sections over inline tables. * Fix TOML encoder to quote keys containing special characters. * Add string slicing support. * Fix findInArray misuse on MappingNodes in equality and contains. * Fix panic on negative slice indices that underflow after adjustment. * Fix stack overflow from circular alias in traverse. * Fix panic and OOM in repeatString for large repeat counts. - update to v4.52.5 * Fix: reset TOML decoder state between files. * Fix: preserve original filename when using --front-matter. - Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`). - Fix CVE-2026-33814 (bsc#1266248): * update golang.org/x/net to v0.53.0. - update to 4.52.4: * Dropping windows/arm - no longer supported in cross-compile * Fixing comments in TOML arrays * Bumped dependencies - update to 4.52.2: * Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst * Fixed TOML table scope after comments(#2588) Thanks @tomers * Multiply uses a readonly context * Fixed merge globbing wildcards in keys * Fixing TOML subarray parsing issue - update to 4.52.1: * TOML encoder support - you can now roundtrip! #1364 * Parent now supports negative indices, and added a 'root' command for referencing the top level document * Fixed scalar encoding for HCL * Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal * Add symlink check to file rename util (#2576) Thanks @Elias- elastisys * Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded * Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters * Added K8S KYAML output format support (#2560) Thanks @robbat2 - update to 4.50.1: * Added HCL Support - First cut - hopefully it works well! * Fixing handling of CRLF #2352 - update to 4.49.2: * Fixing escape character bugs :sweat: #2517 * Fixing snap release pipeline #2518 Thanks @aalexjo - update to 4.49.1: * Added `--security` flags to disable env and file ops #2515 * Fixing TOML ArrayTable parsing issues #1758 * Fixing parsing of escaped characters #2506 - update to 4.48.2: * Strip whitespace when decoding base64 #2507 * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet) * Add linux/loong64 to release target (thanks @znley) * Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx) - update to 4.48.1: * Added 'parents' operator, to return a list of all the hierarchical parents of a node * Added 'first(exp)' operator, to return the first entry matching an expression in an array * Fixed xml namespace prefixes #1730 (thanks @baodrate) * Fixed out of range panic in yaml decoder #2460 (thanks @n471d) * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0. - update to 4.47.2: * Conversion from TOML to JSON nolonger omits empty tables #2459 (thanks @louislouislouislouis) - update to 4.47.1: * Fixed merge anchor behaviour (`
Jun 03, 2026
•Important
OpenSUSE
89
security advisoryfedoraimportantFedora 41: yq Important HTTP Proxy and Input Security Fixes 2025-d8a379a267
Add shell-completions Update to 4.47.1 and adopt go-vendor-tools. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-d8a379a267 2025-09-07 01:12:58.236453+00:00 -------------------------------------------------------------------------------- Name : yq Product : Fedora 41 Version : 4.47.1 Release : 2.fc41 URL : https://github.com/mikefarah/yq Summary : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor Description : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor. -------------------------------------------------------------------------------- Update Information: Add shell-completions Update to 4.47.1 and adopt go-vendor-tools -------------------------------------------------------------------------------- ChangeLog: * Fri Aug 29 2025 Mikel Olasagasti Uranga - 4.47.1-2 - Add shell completions * Thu Aug 21 2025 Romain Geissler - 4.47.1-1 - Upgrade to upstream version 4.47.1 and use vendoring (rhbz#2282002). * Fri Aug 15 2025 Maxwell G - 4.43.1-7 - Rebuild for golang-1.25.0 * Fri Jul 25 2025 Fedora Release Engineering - 4.43.1-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2352349 - CVE-2025-22870 yq: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2352349 [ 2 ] Bug #2360619 - CVE-2025-22872 yq: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2360619 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-d8a379a267' at the command line. For more information,refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Sep 07, 2025
•Important
Fedora
89
security advisoryfedoraimportantFedora 42: yq Important Input Sanitation Issue Fix FEDORA-2025-99309ef35f
Add shell-completions Update to 4.47.1 and adopt go-vendor-tools. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-99309ef35f 2025-09-07 00:51:16.113251+00:00 -------------------------------------------------------------------------------- Name : yq Product : Fedora 42 Version : 4.47.1 Release : 2.fc42 URL : https://github.com/mikefarah/yq Summary : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor Description : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor. -------------------------------------------------------------------------------- Update Information: Add shell-completions Update to 4.47.1 and adopt go-vendor-tools -------------------------------------------------------------------------------- ChangeLog: * Fri Aug 29 2025 Mikel Olasagasti Uranga - 4.47.1-2 - Add shell completions * Thu Aug 21 2025 Romain Geissler - 4.47.1-1 - Upgrade to upstream version 4.47.1 and use vendoring (rhbz#2282002). * Fri Aug 15 2025 Maxwell G - 4.43.1-7 - Rebuild for golang-1.25.0 * Fri Jul 25 2025 Fedora Release Engineering - 4.43.1-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2282002 - v4.44.1 of yq was released https://bugzilla.redhat.com/show_bug.cgi?id=2282002 [ 2 ] Bug #2360655 - CVE-2025-22872 yq: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2360655 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-99309ef35f' at the command line. For more information, refer to the dnf documentation availableat http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Sep 07, 2025
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!