CVE-2026-46378 | Dasel is a command-line tool and library for querying, modif… | CVSS 6.2 MEDIUM

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.

Metadata

CVE ID: CVE-2026-46378
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-13 19:53 UTC
Published: 2026-07-16 17:54 UTC
Last updated: 2026-07-16 17:57 UTC
Primary CWE: CWE-835
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loo…
Vendor / Product: TomWright / dasel
Sources: cve.org · NVD

Severity & Metrics

6.2 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
TomWright	dasel	—	>= 3.0.0, < 3.10.1

Weakness (CWE)

CWE	Source	Description
CWE-835	cna	CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.2	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64 https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64
https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed