CVE-2026-62866: Dasel Command-Line Tool DOS Vulnerability

CVE-2026-62866 Overview

CVE-2026-62866 is an out-of-bounds read vulnerability in Dasel, a command-line tool and library for querying, modifying, and transforming structured data such as JSON, YAML, TOML, and XML. The flaw exists in selector/lexer/tokenize.go within the parseCurRune function. Affected releases span from version 3.0.0 through 3.11.1, and the issue is fixed in version 3.11.2. A selector ending in trailing whitespace, whether supplied directly on the command line or passed programmatically through lexer.NewTokenizer(...).Tokenize() or dasel.Query, triggers an index-out-of-range panic. The panic terminates the running process, producing a denial-of-service condition.

Critical Impact
Any application or workflow that feeds untrusted selector input into Dasel can be crashed on demand, disrupting data pipelines, CI/CD tasks, and long-running services that embed the library.

Affected Products

Dasel command-line tool versions 3.0.0 through 3.11.1
Dasel Go library selector/lexer package versions 3.0.0 through 3.11.1
Applications embedding dasel.Query for user-supplied selector evaluation

Discovery Timeline

2026-09-21 - CVE-2026-62866 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-62866

Vulnerability Analysis

Dasel parses selector expressions using a lexer implemented in selector/lexer/tokenize.go. The parseCurRune function advances the input index p.i past whitespace characters as part of normal token scanning. After skipping the whitespace, the function reads p.src[p.i] to inspect the next rune without first verifying that p.i remains within the bounds of the source buffer. When a selector ends with one or more whitespace characters, the index reaches p.srcLen, and the subsequent read triggers a Go runtime panic classified as an index-out-of-range error [CWE-129: Improper Validation of Array Index].

Because Go panics propagate up the call stack and, when unrecovered, terminate the process, the flaw converts a benign input pattern into a reliable crash primitive. Programs that call Tokenize() or dasel.Query on selectors originating from untrusted sources inherit this failure mode unless they wrap the calls in recover() handlers.

Root Cause

The root cause is a missing end-of-input bounds check after the whitespace-skipping loop. The lexer assumes at least one non-whitespace character follows any whitespace run, an invariant that user-controlled input can violate trivially.

Attack Vector

Exploitation requires the attacker to supply a selector string that terminates with whitespace to a process using a vulnerable Dasel version. The attack vector is local, and no authentication or user interaction is required beyond providing input to the tool or library.

// Patch applied to selector/lexer/tokenize.go
// Adds an end-of-input check after skipping whitespace.

 		p.i++
 	}
 
+	if p.i >= p.srcLen {
+		return NewToken(EOF, "", p.i, 0), nil
+	}
+
 	// Skip over comments
 	if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {
 		p.i += 2

Source: GitHub commit eee03aec28d4a33d6138098d065b7b37b85e3c55. The patch returns an EOF token when the index has reached the end of the source buffer, preventing the unchecked read.

Detection Methods for CVE-2026-62866

Indicators of Compromise

Process termination logs referencing dasel or Go binaries linking github.com/tomwright/dasel with runtime error: index out of range stack traces.
Repeated crashes of services that invoke Dasel against selectors derived from HTTP requests, message queues, or configuration files.
CI/CD pipeline failures where Dasel-based data transformation steps abort with panic output referencing selector/lexer/tokenize.go.

Detection Strategies

Inventory Go binaries and container images for Dasel versions between 3.0.0 and 3.11.1 using software composition analysis or go version -m against compiled artifacts.
Grep source repositories for calls to dasel.Query and lexer.NewTokenizer that pass externally sourced selector strings without input normalization.
Add unit tests that submit selectors ending in space, tab, or newline characters to reproduce the panic in pre-production environments.

Monitoring Recommendations

Forward container and service exit codes along with panic stack traces to a centralized logging platform for correlation.
Alert on abnormal restart rates of workloads that embed Dasel, particularly those exposed to user-controlled query parameters.
Track dependency graphs continuously so new services pulling vulnerable Dasel versions are flagged before deployment.

How to Mitigate CVE-2026-62866

Immediate Actions Required

Upgrade all Dasel command-line installations and Go module dependencies to version 3.11.2 or later.
Rebuild and redeploy any container images, serverless functions, or static binaries that embed the vulnerable Dasel library.
Audit application code paths that expose selector input to untrusted sources and restrict or sanitize that input where feasible.

Patch Information

The fix is delivered in Dasel v3.11.2. Details are documented in the GitHub Security Advisory GHSA-65gg-g7rw-6cpc and the GitHub Release v3.11.2 notes. The corrective commit is eee03aec28d4a33d6138098d065b7b37b85e3c55.

Workarounds

Trim trailing whitespace from selector strings before passing them to dasel.Query or lexer.NewTokenizer(...).Tokenize().
Wrap Dasel invocations in a recover() block so panics are caught and converted to handled errors instead of terminating the process.
Restrict selector input sources to trusted operators until the upgrade to v3.11.2 completes across all environments.

bash

# Upgrade the Dasel CLI to the patched release
go install github.com/tomwright/dasel/v3/cmd/dasel@v3.11.2

# Update the Go module dependency in a project
go get github.com/tomwright/dasel/v3@v3.11.2
go mod tidy

# Verify the installed version
dasel --version