CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed
https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64
https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Dasel es una herramienta de línea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. Desde la versión 3.0.0 hasta la 3.10.1, el cierre matchRegexPattern del analizador léxico de selectores en (Tokenizer).parseCurRune en selector/lexer/tokenize.go entra en un bucle al tokenizar un literal de expresión regular no terminado como r/ porque peekRuneEqual devuelve falso después del final de la entrada, permitiendo que cadenas de selectores controladas por el atacante consuman CPU indefinidamente. Este problema está solucionado en la versión 3.10.1.

Information

Published : 2026-07-16 19:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-46378

Mitre link : CVE-2026-46378

CVE.ORG link : CVE-2026-46378

JSON object : View

Products Affected

No product.

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-46378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46378", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T15:06:25.761486Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "TomWright", "product": "dasel", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.10.1"}]}]}], "published": "2026-07-16T19:16:46.260", "references": [{"url": "https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed", "source": "security-advisories@github.com"}, {"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64", "source": "security-advisories@github.com"}, {"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1."}, {"lang": "es", "value": "Dasel es una herramienta de l\u00ednea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. Desde la versi\u00f3n 3.0.0 hasta la 3.10.1, el cierre matchRegexPattern del analizador l\u00e9xico de selectores en (Tokenizer).parseCurRune en selector/lexer/tokenize.go entra en un bucle al tokenizar un literal de expresi\u00f3n regular no terminado como r/ porque peekRuneEqual devuelve falso despu\u00e9s del final de la entrada, permitiendo que cadenas de selectores controladas por el atacante consuman CPU indefinidamente. Este problema est\u00e1 solucionado en la versi\u00f3n 3.10.1."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}