Threat Intelligence Database

CVE-2026-46378 is a medium severity vulnerability in the TomWright dasel command-line tool and library. Versions from 3.0.0 up to but not including 3.10.1 contain a flaw in the selector lexer where an unterminated regex literal causes an infinite loop during tokenization. This loop results from the peekRuneEqual function returning false at end of input, allowing attacker-controlled selector strings to consume CPU resources indefinitely. The issue is fixed in version 3.10.1.

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.