GHSA-65gg-g7rw-6cpc: Out-of-bounds Read

Published Sep 22, 2026
·
Updated

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60.

The whitespace-skip loop right above (lines 55-57) advances p.i to p.srcLen when the input is all-whitespace or whitespace-trailing. The very next line reads p.src[p.i] without a bounds check.

Vulnerable code

selector/lexer/tokenize.go:53-74 (v3.11.0):

go func (p Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ }

// Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ...

Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.

Reproduce

$ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2

goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...)

Other inputs that hit it: ' ', $'a\t', $'a\n', 'a ?? ', 'a + '. Any token (or no token) followed by whitespace.

Reachable directly from the library too - dasel.Query(ctx, input, "a ") panics the same way. Project-style test reproducer that fails on current main:

go // drop into selector/lexer/ as tokenizetrailingwstest.go package lexertest

import ( "testing" "github.com/tomwright/dasel/v3/selector/lexer" )

func TestTokenizeTrailingWhitespacePanic(t testing.T) { defer func() { if r := recover(); r != nil { t.Fatalf("Tokenize panicked: %v", r) } }() , = lexer.NewTokenizer("a ").Tokenize() }

Impact

Process crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file.

Affected versions

All v3.x. The whitespace-skip loop was added in 78fcca9 (Dasel V3, ~9 months ago); line 60's indexing landed in 9bfe966 (~6 months ago). Reproduced on github.com/tomwright/dasel/v3@v3.11.0.

Suggested fix

One line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71:

go func (p Tokenizer) parseCurRune() (Token, error) { for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ }

if p.i >= p.srcLen { return NewToken(EOF, "", p.i, 0), nil }

if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {

Prevalence

The other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of parseCurRune for other unguarded direct-access points after a pos++ - nothing else stood out. A testing.F harness on lexer.NewTokenizer(s).Tokenize() catches all three with trivially short inputs and would close the class.

Affected Software

1 affected componentFixes available
go/github.com/tomwright/dasel/v3>=3.0.0<3.11.2
3.11.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/github.com/tomwright/dasel/v3 to a version that resolves this vulnerability.

    Fixed in 3.11.2
  2. Compensating control

    In selector/lexer/tokenize.go, after the whitespace-skipping loop in parseCurRune and before accessing p.src[p.i] for comment detection, add a bounds check for p.i >= p.srcLen and return EOF to prevent panics on selectors ending in whitespace.

Event History

Sep 22, 2026
Advisory Published
via GitHub·07:52 PM
Data Sourced
via GitHub·07:52 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Users or systems that invoke dasel with selector input are exposed if an untrusted party can control or influence the selector. The issue can also be triggered during normal local command-line use with a selector that ends in whitespace.

2

What does an attacker need to trigger the failure?

The attacker only needs to supply a selector ending in whitespace, such as `a `. No authentication, user interaction, or specially crafted input document is required.

3

What is the impact of successful exploitation?

Triggering the flaw causes dasel to panic due to an out-of-bounds read in the selector tokenizer. This can terminate the affected process and create a denial-of-service condition.

4

How can I tell whether I am affected?

Run a query using a selector with trailing whitespace, for example `echo '{"a":1}' | dasel query -i json 'a '`. A vulnerable installation panics with an index-out-of-range error referring to `selector/lexer/tokenize.go:60`.

5

What can be done if patching is not immediately possible?

Reject or trim trailing whitespace from selectors before passing them to dasel. Avoid allowing untrusted users to provide selectors until the issue is remediated.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203