mikefarah/yq · error

system operations are disabled, use --security-enable-system

Error message

system operations are disabled, use --security-enable-system-operator to enable

What it means

The `system` operator is opt-in for security reasons: yq will not execute external commands unless explicitly enabled via the --security-enable-system-operator flag (ConfiguredSecurityPreferences.EnableSystemOps). This error is thrown before any expression evaluation, so nothing runs until the flag is set.

Source

Thrown at pkg/yqlib/operator_system.go:63

	if commandNodes.MatchingNodes.Front() == nil {
		return "", fmt.Errorf("system operator: command expression returned no results")
	}
	if commandNodes.MatchingNodes.Len() > 1 {
		log.Debugf("system operator: command expression returned %d results, using first", commandNodes.MatchingNodes.Len())
	}
	cmdNode := commandNodes.MatchingNodes.Front().Value.(*CandidateNode)
	if cmdNode.Kind != ScalarNode || cmdNode.guessTagFromCustomType() != "!!str" {
		return "", fmt.Errorf("system operator: command must be a string scalar")
	}
	if cmdNode.Value == "" {
		return "", fmt.Errorf("system operator: command must be a non-empty string")
	}
	return cmdNode.Value, nil
}

func systemOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {
	if !ConfiguredSecurityPreferences.EnableSystemOps {
		return Context{}, fmt.Errorf("system operations are disabled, use --security-enable-system-operator to enable")
	}

	// determine at parse time whether we have (command; args) or just (command)
	hasArgs := expressionNode.RHS.Operation.OperationType == blockOpType

	var results = list.New()

	for el := context.MatchingNodes.Front(); el != nil; el = el.Next() {
		candidate := el.Value.(*CandidateNode)
		nodeContext := context.SingleReadonlyChildContext(candidate)

		var command string
		var args []string

		if hasArgs {
			block := expressionNode.RHS
			commandNodes, err := d.GetMatchingNodes(nodeContext, block.LHS)
			if err != nil {

View on GitHub (pinned to 8b5af0694b)

Solutions

1. Add the --security-enable-system-operator flag to the yq invocation: `yq --security-enable-system-operator 'system(...)' file.yml`
2. When using yq as a Go library, set ConfiguredSecurityPreferences.EnableSystemOps = true before evaluation
3. If system() was not intentional, remove it from the expression

Example fix

// before
yq 'system("date")' file.yml
// after
yq --security-enable-system-operator 'system("date")' file.yml

// Go library usage
if err != nil && strings.Contains(err.Error(), "system operations are disabled") {
    ConfiguredSecurityPreferences.EnableSystemOps = true // then retry once
}

When it happens

Trigger: Running any expression containing `system(...)` without the --security-enable-system-operator CLI flag, or embedding a `system(...)` expression in a script/library usage where the security preference was never configured.

Common situations: Upgrading yq and hitting the guard on previously working scripts that use system(), running in CI where the flag was omitted from the command line, or calling the library API without setting ConfiguredSecurityPreferences.

Related errors

• env operations have been disabled
• system operator: argument must be a non-null scalar; got kin
• system operator: args must be a non-null scalar or sequence
• system operator: command expression returned no results
• system operator: command must be a string scalar

AI-assisted analysis of mikefarah/yq@8b5af0694b (2026-09-05). Data as JSON: /api/errors/107a2ff84b252bd3. Report an issue: GitHub.