260509.1 · 9d223f153c3632a207fa071caaa6292da33ae361

Reject embedded NUL bytes in module import paths

jq accepts embedded NUL bytes at the language level but resolves module import paths through NUL-terminated C strings, so the path validated by policy or audit code could differ from the on-disk path jq actually opens. Pass jv through gen_import so the AST preserves the original bytes, and reject embedded NULs in validate_relpath.

Fixes CVE-2026-43895.

@@ -33,7 +33,7 @@ block gen_op_pushk_under(jv constant);  block gen_module(block metadata); jv block_module_meta(block b);-block gen_import(const char* name, const char *as, int is_data);+block gen_import(jv name, jv as, int is_data); block gen_import_meta(block import, block metadata); block gen_function(const char* name, block formals, block body); block gen_param_regular(const char* name);