Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-46377 EUVD-2026-44995GHSA-m5j3-4634-c2vqGO-2026-5491

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Published Jul 16, 2026 · Updated Jul 16, 2026 · Assigned by GitHub_M

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.

Affected products

VendorProductAffectedFixed
TomWright dasel >= 3.0.0, < 3.10.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 dasel 3.11.0-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 dasel No fix yet —
Ubuntu 26.04 LTS dasel No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS dasel No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling vale 3.14.2-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/tomwright/dasel all versions — GO-2026-5491
Go github.com/tomwright/dasel/v2 all versions — GO-2026-5491
Go github.com/tomwright/dasel/v3 >= 3.0.0, <= 3.10.0 — GHSA-m5j3-4634-c2vq
Go github.com/tomwright/dasel/v3 >= 3.0.0 — GO-2026-5491

Advisories 1

References