CVE-2026-62866
Received Received - Intake

Path Traversal in Dasel Data Query Tool

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-62866
EUVD
EUVD-2026-84016

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tomwright dasel 3.11.2
tomwright dasel From 3.0.0 (inc) to 3.11.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62866 is a vulnerability in the dasel library affecting versions 3.0.0 to 3.11.2. It causes a panic when processing selectors that end with whitespace. The issue occurs in the parseCurRune function in tokenize.go where the lexer advances the input index past trailing whitespace without checking if the index is still within bounds before reading the next character. This leads to an index-out-of-range error and process termination.

Detection Guidance

To detect this vulnerability, test if the dasel tool crashes when processing selectors with trailing whitespace. Run commands like 'dasel query a ' or 'dasel query "a\t"' and check for process termination. If the tool panics, it is likely affected.

Impact Analysis

This vulnerability can cause a denial of service by crashing the application when a selector ending in whitespace is processed. It requires no authentication or special conditions to trigger, making it exploitable through crafted input. The impact is limited to availability as it does not affect confidentiality or integrity of data.

Compliance Impact

This vulnerability causes a process crash when processing selectors with trailing whitespace, which could lead to denial-of-service conditions in applications using affected versions of dasel. Such crashes may disrupt data processing workflows, potentially violating availability requirements in compliance standards like GDPR (data availability) or HIPAA (system availability for protected health information). However, the vulnerability does not directly impact confidentiality or integrity of data.

Mitigation Strategies

Upgrade dasel to version 3.11.2 or later to apply the fix. If upgrading is not possible, avoid using selectors with trailing whitespace in dasel commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62866. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart