CVE-2025-9403

What it actually does

Local manipulation of inputs to the run_jq_tests function in jq_test.c triggers a reachable assertion failure in the JSON Parser, resulting in process termination.

Why it matters to the business

Organizations relying on the affected JSON processing component face limited local denial-of-service risk that can interrupt testing or parsing workflows when untrusted input is supplied on the same system; the low severity and local-only requirement reduce overall operational urgency despite the package's presence in development ecosystems.

How an attack unfolds

An attacker with local access supplies crafted input to the JSON Parser that reaches the assertion in run_jq_tests; the publicly disclosed technique requires no network access or elevated privileges beyond a local account.

How to fix it

Upgrade kristoferfannar/eslint-ban-moment (GIT) to commit bc2d2f9d23e6ae961a23e0d769e0722870b11108 or later; rebuild and redeploy any dependent packages after applying the fix.

How to confirm the fix worked

Confirm the installed version of the component is at or above the listed fixed commit; re-run the affected test suite with previously crashing inputs to verify the assertion no longer triggers.

Typical attack path

1. Obtain local access to a system running the vulnerable jq component
2. Identify or invoke the run_jq_tests function with manipulated JSON input
3. Trigger the reachable assertion causing an application crash

How to detect it

Review local process logs and core dumps around the time of unexpected jq or JSON parser terminations; inspect build or test logs for repeated assertion failures in jq_test.c.

What your security team should do

• Prioritize patching development and build systems that include the vulnerable package within the next maintenance window
• Scan source repositories and CI pipelines for references to the affected commit range
• Monitor EPSS trend for any future increase that could elevate priority