Infinite Loop Vulnerability in Dasel Command-Line Tool by Tom Wright
CVE-2026-46378

6.2MEDIUM

Key Information:

Vendor

Tomwright

Status
Dasel
Vendor
CVE Published:
16 July 2026

What is CVE-2026-46378?

The Dasel command-line tool is susceptible to an infinite loop vulnerability due to improper handling of unterminated regex literals. Versions from 3.0.0 up to 3.10.1 are affected. The selector lexer matchRegexPattern closure in the Tokenizer's parseCurRune method fails to terminate when encountering incomplete patterns, which can lead to excessive CPU consumption by using attacker-controlled selector strings. This issue has been resolved in version 3.10.1.

Affected Version(s)

dasel >= 3.0.0, < 3.10.1

References

https://github.com/TomWright/dasel/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/TomWright/dasel/commit/95f8dd3af12958b...
x_refsource_MISC

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.