TomWright dasel up to 3.10.0 Lexer tokenize.go parseCurRune infinite loop

Summaryinfo

A vulnerability has been found in TomWright dasel up to 3.10.0 and classified as problematic. This vulnerability affects the function parseCurRune of the file selector/lexer/tokenize.go of the component Lexer. The manipulation leads to infinite loop. This vulnerability is listed as CVE-2026-46378. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in TomWright dasel up to 3.10.0. This issue affects the function parseCurRune of the file selector/lexer/tokenize.go of the component Lexer. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-46378 since 05/13/2026. The exploitation is known to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.10.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• TomWright

Name

• dasel

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10.0

Website

• Product: https://github.com/TomWright/dasel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion