jqlang — Vulnerabilities & Security Advisories 13

jqlang is a query language primarily used for data extraction and manipulation in JSON structures. Historically, it has been associated with vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, often stemming from improper input validation and insecure deserialization. The project has recorded 13 CVEs, with notable issues including arbitrary code execution through crafted queries and server-side template injection. Security researchers have identified consistent patterns of insufficient sanitization in parsing functions, leading to multiple RCE flaws in versions prior to 2022. While recent versions have addressed some concerns, the language's dynamic nature continues to present potential attack surfaces for complex query-based applications.