CVE-2026-62866: Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
daselto a version that resolves this vulnerability.Fixed in 3.11.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Dasel versions from 3.0.0 through 3.11.1 are affected when they process selectors through the lexer, including selectors supplied to lexer.NewTokenizer(...).Tokenize() or dasel.Query. Version 3.11.2 contains the fix.
What input is required to trigger the panic?
A selector that ends with trailing whitespace can trigger the condition. The lexer advances past that whitespace and then attempts to read beyond the end of the input, causing an index-out-of-range panic.
What is the practical impact of successful exploitation?
Triggering the issue terminates the affected process, resulting in a denial of service. The provided scoring indicates no confidentiality or integrity impact.
How can I determine whether an application is vulnerable?
Confirm whether it uses Dasel 3.0.0 through 3.11.1 and passes selector input into the affected lexer or query paths. Processing a selector with trailing whitespace will cause the affected code to panic.