Dasel is a command‑line utility that parses selector expressions. Between versions 3.0.0 and 3.11.2 the lexer function parseCurRune advances past trailing whitespace and then accesses the input slice at the exhausted index without checking the end of the string. This causes an integer out‑of‑bounds read that triggers a panic and terminates the process. The flaw is a classic integer bounds error (CWE‑129) and results in a local denial of service where any supplied selector ending in whitespace can crash the runner.

The vulnerability affects TomWright’s Dasel utility, specifically all releases from 3.0.0 up to and including 3.11.2. Version 3.11.2 and later contain a fix, so the risk applies to users running an earlier, unpatched release.

The CVSS score of 6.2 indicates a moderate severity. No EPSS score is available and the issue is not listed in CISA KEV, but the bug is known and could be triggered by any adversary who can supply a selector with trailing whitespace to a running Dasel instance. If Dasel is executed with elevated privileges or as part of a service, an attacker could cause the service to terminate, leading to a denial of availability. The attack vector is local; there is no identified mechanism for remote exploitation or code injection, so the risk is confined to denial of service with privileged contexts giving potential collateral impact.