Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-21T17:17:38.053Z",
  "pubdate": "2026-09-21T17:17:38.053Z",
  "executiveSummary": "Dasel versions 3.0.0 through 3.11.2 are susceptible to a Denial-of-Service (DoS) vulnerability caused by an unhandled index-out-of-range condition.\nThe vulnerability originates in the selector/lexer/tokenize.go component within the parseCurRune function, specifically when processing input containing trailing whitespace.\nBy supplying a specially crafted selector that terminates with whitespace, an attacker can trigger a panic during the tokenization process, resulting in the immediate termination of the dasel process.\nThis vulnerability poses a significant risk to any application relying on dasel for data processing, as it allows for the disruption of service execution via malformed input.\nExploitation does not require authentication or elevated privileges, provided the attacker can influence the input parsed by lexer.NewTokenizer or dasel.Query.\nThe primary impact is service unavailability due to process crashes, potentially leading to cascading failures in downstream services dependent on data transformation tasks.",
  "technicalDetails": "The vulnerability resides in the parseCurRune function located within the selector/lexer/tokenize.go file of the dasel codebase. The root cause of the flaw is an inadequate boundary check during the lexical analysis phase.\nDuring tokenization, the lexer is responsible for transforming raw input strings into logical tokens. When the parseCurRune function encounters whitespace at the end of a selector expression, it correctly advances the input index to skip this whitespace. However, the implementation fails to perform a validation check to ensure that the index has not exceeded the bounds of the underlying data structure after this advancement.\nSpecifically, after the index is incremented to account for trailing whitespace, the logic attempts to read the source data at the newly calculated index. If this index is equal to or greater than the length of the input, the runtime environment encounters an index-out-of-range condition.\nIn the Go programming language, an index-out-of-range error results in a panic, which, if unrecovered, immediately terminates the execution of the process.\nAn attacker can exploit this by submitting a payload that ends in whitespace through interfaces such as lexer.NewTokenizer(...).Tokenize() or the higher-level dasel.Query function. The flow begins with the arrival of the malicious input string; the lexer enters the affected code path within parseCurRune, advances past the whitespace, and then performs a read operation on memory outside the allocated buffer boundaries.\nThis vulnerability is present in all dasel versions from 3.0.0 up to and including 3.11.1. It is effectively a denial-of-service vector where the system's stability is compromised simply by providing non-conforming, yet syntactically valid, input strings.\nBecause dasel is frequently used in automated data pipelines or as a CLI utility for infrastructure automation, the ability to crash the tool by providing malformed query parameters can facilitate a denial-of-service attack, potentially halting critical deployment or configuration synchronization processes that rely on dasel for dynamic data modification."
}