CVE-2026-46377: falha de média gravidade em TomWright dasel
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.2%
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
TomWright · daselCVEs relacionadas — TomWright dasel
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33320MEDIUMDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceEPSS 0.2%CVE-2026-62866MEDIUMDasel: Selector lexer panics on trailing whitespace in `parseCurRune`EPSS 0.2%CVE-2026-46378MEDIUMDasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalEPSS 0.2%CVE-2026-59168MEDIUMDasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSEPSS 0.1%