What causes "env operations have been disabled" in mikefarah/yq?

Remove env() usage from the expression and pass values via --from-file, arguments, or interpolated input

env operations have been disabled

Error message

env operations have been disabled

What it means

yq's `env` operator reads environment variables at evaluation time. For security, yq supports compiling/running with DisableEnvOps set (e.g. when processing untrusted input); when enabled, any use of `env(...)` is refused outright with this error. The library intentionally blocks environment access rather than silently returning empty values.

Source

Thrown at pkg/yqlib/operator_env.go:21

import (
	"container/list"
	"fmt"
	"os"
	"strings"

	parse "github.com/a8m/envsubst/parse"
)

type envOpPreferences struct {
	StringValue bool
	NoUnset     bool
	NoEmpty     bool
	FailFast    bool
}

func envOperator(_ *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {
	if ConfiguredSecurityPreferences.DisableEnvOps {
		return Context{}, fmt.Errorf("env operations have been disabled")
	}
	envName := expressionNode.Operation.CandidateNode.Value
	log.Debugf("EnvOperator, env name: %v", envName)

	rawValue := os.Getenv(envName)

	preferences := expressionNode.Operation.Preferences.(envOpPreferences)

	var node *CandidateNode
	if preferences.StringValue {
		node = &CandidateNode{
			Kind:  ScalarNode,
			Tag:   "!!str",
			Value: rawValue,
		}
	} else if rawValue == "" {
		return Context{}, fmt.Errorf("value for env variable '%v' not provided in env()", envName)
	} else {

View on GitHub (pinned to 8b5af0694b)

Solutions

Remove env() usage from the expression and pass values via --from-file, arguments, or interpolated input
Rebuild/reconfigure yq with ConfiguredSecurityPreferences.DisableEnvOps = false if env access is trusted
Pre-resolve variables in the shell before invoking yq: MY=$(printenv MY) yq '.x = strenv(MY)' is also blocked — instead substitute literally
Contact whoever ships the hardened binary to confirm the policy before changing expressions

Defensive patterns

Strategy: fallback

Validate before calling

# detect a hardened build before running env-dependent expressions
yq --version && grep -R 'DisableEnvOps' build-config/ || true

Try / catch

out=$(yq '.x = env(TOKEN)' f.yaml 2>&1) || {
  echo "env ops unavailable, injecting value instead" >&2
  yq ".x = \"$TOKEN\"" f.yaml
}

Prevention

Keep expressions env-free for hardened builds; inject values as arguments
Document which yq builds in your CI disable env ops
Prefer passing secrets via files/args rather than env()

When it happens

Trigger: Evaluating an expression containing `env(MY_VAR)` or `stenv` while the yq binary/pipeline was built or configured with ConfiguredSecurityPreferences.DisableEnvOps = true.

Common situations: Using a hardened yq build for CI on untrusted files; an embedder of the yqlib package set DisableEnvOps for safety; environment policy changed and older expressions using env() now fail.

Related errors

AI-assisted analysis of mikefarah/yq@8b5af0694b (2026-09-05). Data as JSON: /api/errors/51be2dcef408a572. Report an issue: GitHub.