{"record":{"id":"107a2ff84b252bd3","repo":"mikefarah/yq","slug":"system-operations-are-disabled-use-security-ena","errorCode":null,"errorMessage":"system operations are disabled, use --security-enable-system-operator to enable","messagePattern":"system operations are disabled, use --security-enable-system-operator to enable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/yqlib/operator_system.go","lineNumber":63,"sourceCode":"\tif commandNodes.MatchingNodes.Front() == nil {\n\t\treturn \"\", fmt.Errorf(\"system operator: command expression returned no results\")\n\t}\n\tif commandNodes.MatchingNodes.Len() > 1 {\n\t\tlog.Debugf(\"system operator: command expression returned %d results, using first\", commandNodes.MatchingNodes.Len())\n\t}\n\tcmdNode := commandNodes.MatchingNodes.Front().Value.(*CandidateNode)\n\tif cmdNode.Kind != ScalarNode || cmdNode.guessTagFromCustomType() != \"!!str\" {\n\t\treturn \"\", fmt.Errorf(\"system operator: command must be a string scalar\")\n\t}\n\tif cmdNode.Value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"system operator: command must be a non-empty string\")\n\t}\n\treturn cmdNode.Value, nil\n}\n\nfunc systemOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {\n\tif !ConfiguredSecurityPreferences.EnableSystemOps {\n\t\treturn Context{}, fmt.Errorf(\"system operations are disabled, use --security-enable-system-operator to enable\")\n\t}\n\n\t// determine at parse time whether we have (command; args) or just (command)\n\thasArgs := expressionNode.RHS.Operation.OperationType == blockOpType\n\n\tvar results = list.New()\n\n\tfor el := context.MatchingNodes.Front(); el != nil; el = el.Next() {\n\t\tcandidate := el.Value.(*CandidateNode)\n\t\tnodeContext := context.SingleReadonlyChildContext(candidate)\n\n\t\tvar command string\n\t\tvar args []string\n\n\t\tif hasArgs {\n\t\t\tblock := expressionNode.RHS\n\t\t\tcommandNodes, err := d.GetMatchingNodes(nodeContext, block.LHS)\n\t\t\tif err != nil {","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/mikefarah/yq/blob/8b5af0694bb82b41d4ae180fac9972029066f90a/pkg/yqlib/operator_system.go#L45-L81","documentation":"The `system` operator is opt-in for security reasons: yq will not execute external commands unless explicitly enabled via the --security-enable-system-operator flag (ConfiguredSecurityPreferences.EnableSystemOps). This error is thrown before any expression evaluation, so nothing runs until the flag is set.","triggerScenarios":"Running any expression containing `system(...)` without the --security-enable-system-operator CLI flag, or embedding a `system(...)` expression in a script/library usage where the security preference was never configured.","commonSituations":"Upgrading yq and hitting the guard on previously working scripts that use system(), running in CI where the flag was omitted from the command line, or calling the library API without setting ConfiguredSecurityPreferences.","solutions":["Add the --security-enable-system-operator flag to the yq invocation: `yq --security-enable-system-operator 'system(...)' file.yml`","When using yq as a Go library, set ConfiguredSecurityPreferences.EnableSystemOps = true before evaluation","If system() was not intentional, remove it from the expression"],"exampleFix":"// before\nyq 'system(\"date\")' file.yml\n// after\nyq --security-enable-system-operator 'system(\"date\")' file.yml","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go library usage\nif err != nil && strings.Contains(err.Error(), \"system operations are disabled\") {\n    ConfiguredSecurityPreferences.EnableSystemOps = true // then retry once\n}","preventionTips":["Always pass --security-enable-system-operator when scripts use system()","Set EnableSystemOps = true at library initialization before evaluating expressions","Avoid system() in expressions meant for untrusted/restricted environments"],"tags":["yq","system-operator","security","configuration"],"backgroundTag":"operation-not-permitted","analyzedSha":"8b5af0694bb82b41d4ae180fac9972029066f90a","analyzedAt":"2026-09-05T10:57:22.766Z","contentChangedAt":"2026-09-05T10:57:22.766Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}