CVE-2026-62866 Details
Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
A vulnerability in Dasel versions 3.0.0 prior to 3.11.2 allows for an index-out-of-range panic in the selector lexer. The issue arises in the 'parseCurRune' function, where the input index is advanced across trailing whitespace. This loop can push the index to the end of the input, after which the function attempts to read the source without a proper bounds check. As a result, a selector ending in whitespace can cause a runtime panic, crashing the process. The vulnerability can be triggered using 'dasel query' with a trailing space, tab, or newline, among other inputs.
Users can upgrade to Dasel version 3.11.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55 | [email protected] | Source CodeVendor |
| https://github.com/TomWright/dasel/releases/tag/v3.11.2 | [email protected] | Release NotesVendor |
| https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TomWright Dasel | ~3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |