CVE-2026-62866: falha de média gravidade em TomWright dasel
Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.2%
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
TomWright · daselCVEs relacionadas — TomWright dasel
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33320MEDIUMDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceEPSS 0.2%CVE-2026-46377MEDIUMDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringEPSS 0.2%CVE-2026-46378MEDIUMDasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalEPSS 0.2%CVE-2026-59168MEDIUMDasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSEPSS 0.1%