#1144075 jq: src/compile.c:1086: nesting_level: Assertion `bc && target && target->compiled' failed.

Package:
jq
Source:
jq
Description:
lightweight and flexible command-line JSON processor
Submitter:
Tianon Gravi
Date:
2026-08-10 18:41:01 UTC
Severity:
normal
Tags:
#1144075#5
Date:
2026-08-10 18:30:54 UTC
From:
To:
The upstream fix for CVE-2026-44777 [1] causes a severe regression in
`jq`'s handling of transitive `include` instructions.

[1]: https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c

    $ cat foo.jq
    include "bar";
    def foo: bar;
    $ cat bar.jq
    include "baz";
    def bar: baz;
    $ cat baz.jq
    def baz: "baz";
    $ jq -n 'include "foo"; foo'
    jq: src/compile.c:1179: expand_call_arglist: Assertion `0 && "Unknown function type"' failed.
    Aborted

There is an upstream issue at [2] and an upstream PR at [3] (neither
resolved yet).

[2]: https://github.com/jqlang/jq/issues/3597
[3]: https://github.com/jqlang/jq/pull/3570

Previously this only affected 1.8.2 upstream, but with the recent
security backports, this now affects Stable's 1.7.1 too.