Technical impact
Dasel is a command‑line tool and library for querying, modifying, and transforming data structures. From version 3.0.0 through 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string, then attempts to read p.src[pos] without a bounds check. This bug allows attacker‑controlled selector strings to trigger a Go index‑out‑of‑range panic, causing Dasel to terminate unexpectedly. The resulting panic effectively denies service to any user or component that relies on the tool.
Affected Systems
The vulnerability affects the TomWright dasel command‑line utility and library for all releases from 3.0.0 up to but not including the fixed 3.10.1 release. The patch was applied in version 3.10.1, which removes the vulnerable lexer logic.
Risk and Exploitability
The CVSS score of 6.2 indicates moderate exploitation impact. The EPSS score of < 1% reflects a very low probability that this vulnerability will be actively exploited in the wild. Dasel is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local user or untrusted input supplied to Dasel that contains a selector string with an escaped backslash in a quoted string, causing the parse routine to panic. If exploited, the result is a denial‑of‑service condition rather than code execution or data exfiltration.
Github GHSA