Dasel is a command‑line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker‑controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1. The flaw is equivalent to CWE‑835 and permits an attacker to trigger a denial of service by supplying a malicious selector string. The vulnerability does not grant code execution or privilege escalation; its effect is limited to exhausting CPU time on the host running Dasel.

The vulnerability affects the TomWright Dasel project, specifically all releases from 3.0.0 up to and including 3.10.0. Version 3.10.1 contains the fix and no longer contains the infinite‑loop bug.

The CVSS score of 6.2 indicates a moderate severity. The EPSS score is less than 1%, implying a low probability of widespread exploitation. Dasel is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker providing a crafted selector string; this could happen through automated processing pipelines or any environment where Dasel is exposed to untrusted. If exploited, the attacker can cause high CPU usage and service disruption, but the impact is limited to the host running Dasel.