Dashboard / CVE-2026-44777

CVE-2026-44777

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 36/100
Published: 2026-05-11 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: None
VI: None
VA: High

Description

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
jqlang jq < 1.8.2

References & Advisories (1)

Bug Bounty Relevance

36 / 100
✓ No authentication
✓ Low complexity

CVSS Score

5.4 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.16%
Raw Score 0.001610
Percentile 5.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00161
2026-10-28
0.00161

Intelligence Sources

nvd ref →

External Links