Executive brief
Dasel is a command-line tool and library used for querying and transforming data structures like JSON, YAML, and XML. A vulnerability in how it processes query strings allows an attacker to crash the application by providing a specially crafted query ending in a backslash. This results in a denial-of-service, potentially disrupting automated workflows or web services that rely on the tool to process data.
Technical details
An index-out-of-range vulnerability exists in the dasel selector lexer within the `(*Tokenizer).parseCurRune` function in `selector/lexer/tokenize.go`. When the lexer encounters an escape character (backslash) as the final character of a quoted string, it increments the position pointer beyond the source buffer's length and attempts a read without a bounds check. This causes a Go runtime panic. An attacker who can influence the selector or query string passed to dasel can exploit this to cause a denial-of-service (DoS) by crashing the process. The issue is resolved in version 3.10.1 by adding a check for `UnexpectedEOFError`.
Affected products
- TomWright dasel >= 3.0.0, < 3.10.1
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-13: patched: Version 3.10.1 released with fix
- 2026-07-16: disclosed: CVE-2026-46377 published to NVD