{"id":"CVE-2026-46377","sourceIdentifier":"security-advisories@github.com","published":"2026-07-16T19:16:46.127","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or '\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."},{"lang":"es","value":"Dasel es una herramienta de línea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. Desde la versión 3.0.0 hasta la 3.10.1, el gestor de secuencias de escape en (Tokenizer).parseCurRune en selector/lexer/tokenize.go incrementa más allá de una barra invertida final en una cadena entrecomillada como ’\\’ o ’\\’ y luego lee p.src[pos] sin una comprobación de límites, permitiendo que cadenas de selector controladas por el atacante activen un pánico de Go por índice fuera de rango. Este problema está solucionado en la versión 3.10.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TomWright","product":"dasel","versions":[{"version":">= 3.0.0, < 3.10.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-16T18:21:25.556634Z","id":"CVE-2026-46377","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c","source":"security-advisories@github.com"},{"url":"https://github.com/TomWright/dasel/releases/tag/v3.10.1","source":"security-advisories@github.com"},{"url":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq","source":"security-advisories@github.com"},{"url":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}