Executive brief
Dasel is a library and CLI tool for querying and modifying structured data formats like JSON. An attacker can crash the process by providing a selector query with trailing whitespace, causing an uncontrolled panic that disrupts service availability. This affects any application using Dasel to parse untrusted selector inputs.
Technical details
The vulnerability is a panic (runtime error: index out of range) in the selector lexer's `parseCurRune()` function in `selector/lexer/tokenize.go`. The whitespace-skipping loop (lines 55–57) advances the position pointer `p.i` to `p.srcLen` when encountering trailing whitespace, but the subsequent line 60 reads `p.src[p.i]` without bounds checking. This allows the parser to access memory outside the input string bounds. The vulnerability is reachable directly via the library API (`dasel.Query()`) or indirectly through the CLI tool with any selector ending in whitespace (e.g., `'a '`, `' '`, `'a\t'`, `'a + '`). No authentication or user interaction is required; only network reachability to an application using Dasel for untrusted selector input parsing.
Affected products
- Tom Wright Dasel v3.x (all versions through v3.11.0)
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory: GHSA-65gg-g7rw-6cpc published