EUVD-2026-84016Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Selector input is supplied locally to a CLI/library (AV:L), trigger is trivial and reliable (AC:L, PR:N, UI:N), and the sole effect is a process-crashing panic (A:H, C:N/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
AnalysisAI
Trailing whitespace at the end of a selector string makes Dasel 3.0.0 through 3.11.1 read past the end of its input and panic with an index-out-of-range error, terminating the process - an availability-only denial of service. The trigger is trivially small (dasel query 'a ', or a selector ending in a tab or newline) and is reachable both from the command line and from the Go library entry points dasel.Query and lexer.NewTokenizer(...).Tokenize(), so any embedding application that forwards caller-influenced selector text into Dasel can be crashed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that an attacker can supply or influence the selector/query string handed to Dasel versions 3.0.0 through 3.11.1 - either as a command-line argument (dasel query '<selector>') or via the library entry points lexer.NewTokenizer(...).Tokenize() and dasel.Query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority availability-only defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dasel 3.11.2, the vendor-released patch (https://github.com/TomWright/dasel/releases/tag/v3.11.2), which contains the end-of-input bounds check introduced in commit eee03aec28d4a33d6138098d065b7b37b85e3c55; the change is internal to the lexer, so CLI users only need a binary upgrade and Go embedders only need 'go get github.com/TomWright/dasel@v3.11.2' with no API changes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today