CVE-2026-62866: Dasel selector lexer panic on trailing whitespace

CVE-2026-62866 · Severity: medium · CVSS 6.2 · Published 2026-09-21

Dasel is a library and CLI tool for querying and modifying structured data formats like JSON. An attacker can crash the process by providing a selector query with trailing whitespace, causing an uncontrolled panic that disrupts service availability. This affects any application using Dasel to parse untrusted selector inputs.

Technologies: github.com/tomwright/dasel (Go), github.com/tomwright/dasel/v2 (Go), github.com/tomwright/dasel/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-62866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62866 being exploited in the wild.
How severe is CVE-2026-62866?
Medium severity, with a CVSS score of 6.2, published 21 September 2026.
Which products and versions are affected?
github.com/tomwright/dasel (Go) SEMVER:introduced=0; github.com/tomwright/dasel/v2 (Go) SEMVER:introduced=0; github.com/tomwright/dasel/v3 (Go) >= 3.0.0, < 3.11.2, SEMVER:introduced=3.0.0,fixed=3.11.2.
Is there a fix for CVE-2026-62866?
Yes. github.com/tomwright/dasel/v3 (Go): upgrade to 3.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62866 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62866?
Check whether you run github.com/tomwright/dasel (Go), github.com/tomwright/dasel/v2 (Go) or github.com/tomwright/dasel/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/tomwright/dasel/v3 (Go): upgrade to 3.11.2 or later
    go get github.com/tomwright/dasel/v3@v3.11.2

Technical details

The vulnerability is a panic (runtime error: index out of range) in the selector lexer's `parseCurRune()` function in `selector/lexer/tokenize.go`. The whitespace-skipping loop (lines 55–57) advances the position pointer `p.i` to `p.srcLen` when encountering trailing whitespace, but the subsequent line 60 reads `p.src[p.i]` without bounds checking. This allows the parser to access memory outside the input string bounds. The vulnerability is reachable directly via the library API (`dasel.Query()`) or indirectly through the CLI tool with any selector ending in whitespace (e.g., `'a '`, `' '`, `'a\t'`, `'a + '`). No authentication or user interaction is required; only network reachability to an application using Dasel for untrusted selector input parsing.

Affected products

  • Tom Wright Dasel v3.x (all versions through v3.11.0)

Identifiers

  • CVE-2026-62866
  • GHSA-65gg-g7rw-6cpc
  • GO-2026-6548

Timeline

  • 2026-09-22: disclosed
  • 2026-09-22: advisory: GHSA-65gg-g7rw-6cpc published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.