Denial of Service Vulnerability in Dasel Command-Line Tool by Tom Wright
CVE-2026-33320
Key Information:
Badges
What is CVE-2026-33320?
The Dasel command-line tool, widely used for querying and transforming data structures, has a vulnerability that can lead to Denial of Service. Versions 3.0.0 through 3.3.0 allow an attacker to exploit the YAML reader's UnmarshalYAML implementation. By providing specially crafted YAML files, an attacker can induce excessive CPU and memory usage, leading to potential service interruptions. This is due to the library's method of resolving alias nodes without constraints. The vulnerability has been addressed in version 3.3.2, which includes a patch to prevent such abuse.
Affected Version(s)
dasel >= 3.0.0, < 3.3.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.