Input Index Vulnerability in Dasel Tool by Tom Wright
CVE-2026-62866
6.2MEDIUM
What is CVE-2026-62866?
Dasel, a command-line tool and library for querying and transforming data structures, has a vulnerability present from version 3.0.0 to 3.11.2. This vulnerability arises when the input index is advanced across trailing whitespace without a proper end-of-input check, leading to an index-out-of-range panic. As a result, processes can terminate unexpectedly when a selector ends with whitespace in functions such as lexer.NewTokenizer(...).Tokenize() or dasel.Query. This issue has been addressed in version 3.11.2.
Affected Version(s)
dasel >= 3.0.0, < 3.11.2