Executive brief
Dasel is a command-line tool and library used to query and modify data structures like JSON, YAML, and XML. A flaw in how it processes search queries allows an attacker to provide a specially crafted, incomplete query that causes the software to enter an infinite loop. This results in 100% CPU usage, potentially leading to a denial-of-service condition where the application or system becomes unresponsive.
Technical details
A vulnerability exists in the selector lexer of Dasel within the matchRegexPattern closure of (*Tokenizer).parseCurRune in selector/lexer/tokenize.go. The lexer fails to perform bounds-checking against the input length when encountering an unterminated regex literal (e.g., 'r/'). Because the peekRuneEqual function returns false at the end of input, the loop condition remains true, causing the tokenizer to increment the position pointer indefinitely. This results in an infinite loop that consumes 100% CPU on a single core. The issue is fixed in version 3.10.1 by implementing proper EOF checks during regex tokenization.
Affected products
- TomWright dasel >= 3.0.0, < 3.10.1
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE-2026-46378 published to NVD
- 2026-07-16: patched: Fix included in version 3.10.1