Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-62866 EUVD-2026-84016GHSA-65gg-g7rw-6cpcGO-2026-6548

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Published Sep 21, 2026 · Updated Sep 21, 2026 · Assigned by GitHub_M

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Affected products

VendorProductAffectedFixed
TomWright dasel >= 3.0.0, < 3.11.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 dasel 3.11.2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 dasel No fix yet —
Ubuntu 26.04 LTS dasel No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS dasel No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling vale 3.22.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/tomwright/dasel all versions — GO-2026-6548
Go github.com/tomwright/dasel/v2 all versions — GO-2026-6548
Go github.com/tomwright/dasel/v3 >= 3.0.0, < 3.11.2 3.11.2 GHSA-65gg-g7rw-6cpc

References