Command-Line Tool Vulnerability in Dasel by Tom Wright

CVE-2026-59168

What is CVE-2026-59168?

The Dasel command-line tool and library, which enables querying, modifying, and transforming data structures, is susceptible to a stack exhaustion vulnerability. This occurs due to a lack of depth guarding in its JSON and XML parsing functionalities. If an attacker supplies deeply nested JSON or XML data through the parsing interface, it can lead to an uncontrolled increase in goroutine stack usage, culminating in a fatal error that crashes the process. This flaw exists in versions 3.0.0 through 3.11.1 and compromises the stability of applications leveraging Dasel. The issue has been addressed in version 3.11.1.

References