CVE-2026-46377 Details
Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.
A vulnerability in the Dasel command-line tool and library, affecting versions 3.0.0 through 3.10.1, allows for a Go index-out-of-range panic. This issue arises in the escape sequence handler of the selector lexer, where a trailing backslash in a quoted string is not properly handled. The lack of a bounds check enables attacker-controlled selector strings to trigger this panic, causing a process crash. The vulnerability is present in the escape sequence handling of the tokenizer, which fails to check for the end of the input when processing escape characters. As a result, the tokenizer can read past the available data, leading to a runtime error.
Users can upgrade to Dasel version 3.10.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c | [email protected] | Source CodeVendor |
| https://github.com/TomWright/dasel/releases/tag/v3.10.1 | [email protected] | Release NotesVendor |
| https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TomWright dasel | >= 3.0.0, <= 3.10.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | New CVE Received | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |