Back to overview

CVE-2026-46377

MEDIUM Exploitation: PoC
6.2
CVSS 3.1
Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.

Metadata

CVE ID
CVE-2026-46377
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-13 19:53 UTC
Published
2026-07-16 17:57 UTC
Last updated
2026-07-16 18:21 UTC
Primary CWE
CWE-129
CWE-129: Improper Validation of Array Index
Vendor / Product
TomWright / dasel
Sources
cve.org  ·  NVD

Severity & Metrics

6.2 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
TomWright dasel — >= 3.0.0, < 3.10.1
Weakness (CWE)
CWESourceDescription
CWE-129 cna CWE-129: Improper Validation of Array Index
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.2 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (3)
Back to overview