{"id":"EUVD-2026-44995","enisaUuid":"817292db-715b-37d1-bc68-c0b51fc26b17","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or \u0027\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.","datePublished":"Jul 16, 2026, 5:57:16 PM","dateUpdated":"Jul 16, 2026, 6:21:45 PM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq\nhttps://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c\nhttps://github.com/TomWright/dasel/releases/tag/v3.10.1\n","aliases":"CVE-2026-46377\nGHSA-m5j3-4634-c2vq\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"e5596f19-cf60-3967-bba4-e19c5e6882f9","product":{"name":"dasel","vendor":{"name":"TomWright"}},"product_version":"3.0.0, \u003c 3.10.1"}],"enisaIdVendor":[{"id":"2ddeffa5-16c4-30dc-a312-430a6a0b7f17","vendor":{"name":"TomWright"}}],"enisaIdVulnerability":[{"id":"4be66f37-d60b-3c4b-ba31-8abecbdce4ea","vulnerability":{"id":"CVE-2026-46377","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or \u0027\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.","datePublished":"Jul 16, 2026, 5:57:16 PM","dateUpdated":"Jul 16, 2026, 6:21:45 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq\nhttps://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c\nhttps://github.com/TomWright/dasel/releases/tag/v3.10.1\n","enisa_id":"EUVD-2026-44995\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 28, 2026, 7:17:57 AM","vulnerabilityProduct":[{"id":"dc79740a-0adc-3711-a064-b0b0c40b7c1c","product":{"name":"dasel","vendor":{"name":"TomWright"}},"product_version":"3.0.0, \u003c 3.10.1"}],"vulnerabilityVendor":[{"id":"2fa23e75-ee57-3d8e-98e9-1c8b4a9a92e7","vendor":{"name":"TomWright"}}]}},{"id":"a98d79cd-4467-31f8-9876-a0bfb50d8213","vulnerability":{"id":"GHSA-m5j3-4634-c2vq","description":"Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string","datePublished":"May 19, 2026, 8:08:12 PM","dateUpdated":"May 19, 2026, 8:08:12 PM","baseScore":0.0,"references":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq\nhttps://github.com/TomWright/dasel\n","enisa_id":"EUVD-2026-44995\n","aliases":"GHSA-m5j3-4634-c2vq\nCVE-2026-46377\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}