{"id":"EUVD-2026-84016","revision":null,"records":[{"revision":"b9b058628956403b9cfe165510d6cd6d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62866","aliases":[],"title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","state":0,"publishedAt":"2026-09-21T16:51:18.52+00:00","modifiedAt":"2026-09-21T18:00:18.178+00:00","affected":[{"ecosystem":"Vendor product","name":"dasel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"TomWright\",\n                    \"product\": \"dasel\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.0.0, < 3.11.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc","https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","https://github.com/TomWright/dasel/releases/tag/v3.11.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62866","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62866","identifiers":["CVE-2026-62866"]},"retained":false,"historicalAffected":[]},{"revision":"59ff41bfa3d54dbb9c3953fcbd3fe90e","observedAt":"2026-11-11T15:05:09.777+00:00","statement":{"source":"euvd","id":"EUVD-2026-84016","aliases":["CVE-2026-62866","GHSA-65gg-g7rw-6cpc"],"title":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the sour…","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":null}],"references":["https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc","https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","https://github.com/TomWright/dasel/releases/tag/v3.11.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84016","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 21, 2026, 4:51:18 PM","dateUpdated":"Sep 21, 2026, 6:00:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84016","identifiers":["EUVD-2026-84016","CVE-2026-62866","GHSA-65gg-g7rw-6cpc"]},"retained":false,"historicalAffected":[]},{"revision":"925e4b3f3d7e48e49978e088e6406963","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-62866","aliases":[],"title":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the sour…","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","state":0,"publishedAt":"2026-09-21T17:17:38.053+00:00","modifiedAt":"2026-09-24T21:25:27.05+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","https://github.com/TomWright/dasel/releases/tag/v3.11.2","https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62866","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-129"],"productCriteria":[],"sourceDates":{"published":"2026-09-21T17:17:38.053","lastModified":"2026-09-24T21:25:27.050"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-62866","identifiers":["CVE-2026-62866"]},"retained":false,"historicalAffected":[]},{"revision":"2369d4d74f3e4e6ebe55f43462a2ee57","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-65gg-g7rw-6cpc","aliases":["CVE-2026-62866","GO-2026-6548"],"title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`.\n\nThe whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check.\n\n## Vulnerable code\n\n`selector/lexer/tokenize.go:53-74` (v3.11.0):\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\t// Skip over whitespace\n\tfor p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\t// Skip over comments\n\tif p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {\n\t\t// ...\n```\n\nLines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.\n\n## Reproduce\n\n```\n$ echo '{\"a\":1}' | dasel query -i json 'a '\npanic: runtime error: index out of range [2] with length 2\n\ngoroutine 1 [running]:\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...)\n\tselector/lexer/tokenize.go:60\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...)\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...)\ngithub.com/tomwright/dasel/v3/selector.Parse(...)\ngithub.com/tomwright/dasel/v3/execution.ExecuteSelector(...)\n```\n\nOther inputs that hit it: `'   '`, `$'a\\t'`, `$'a\\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace.\n\nReachable directly from the library too - `dasel.Query(ctx, input, \"a \")` panics the same way. Project-style test reproducer that fails on current `main`:\n\n```go\n// drop into selector/lexer/ as tokenize_trailing_ws_test.go\npackage lexer_test\n\nimport (\n\t\"testing\"\n\t\"github.com/tomwright/dasel/v3/selector/lexer\"\n)\n\nfunc TestTokenize_TrailingWhitespacePanic(t *testing.T) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Fatalf(\"Tokenize panicked: %v\", r)\n\t\t}\n\t}()\n\t_, _ = lexer.NewTokenizer(\"a \").Tokenize()\n}\n```\n\n## Impact\n\nProcess crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file.\n\n## Affected versions\n\nAll v3.x. The whitespace-skip loop was added in `78fcca9` (Dasel V3, ~9 months ago); line 60's indexing landed in `9bfe966` (~6 months ago). Reproduced on `github.com/tomwright/dasel/v3@v3.11.0`.\n\n## Suggested fix\n\nOne line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71:\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\tfor p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\tif p.i >= p.srcLen {\n\t\treturn NewToken(EOF, \"\", p.i, 0), nil\n\t}\n\n\tif p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {\n```\n\n## Prevalence\n\nThe other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.","state":0,"publishedAt":"2026-09-22T19:52:16+00:00","modifiedAt":"2026-10-01T20:55:58.3901677+00:00","affected":[{"ecosystem":"Go","name":"github.com/tomwright/dasel/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.11.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc","https://nvd.nist.gov/vuln/detail/CVE-2026-62866","https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","https://github.com/TomWright/dasel","https://github.com/TomWright/dasel/releases/tag/v3.11.2"],"sourceUrl":"https://github.com/advisories/GHSA-65gg-g7rw-6cpc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-65gg-g7rw-6cpc","identifiers":["GHSA-65gg-g7rw-6cpc","CVE-2026-62866","GO-2026-6548"]},"retained":false,"historicalAffected":[]},{"revision":"add12ac33fb442d29646617144eb6e70","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6548","aliases":["CVE-2026-62866","GHSA-65gg-g7rw-6cpc"],"title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel","description":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:12.2271963+00:00","affected":[{"ecosystem":"Go","name":"github.com/tomwright/dasel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tomwright/dasel/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tomwright/dasel/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.11.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc","https://nvd.nist.gov/vuln/detail/CVE-2026-62866","https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","https://github.com/TomWright/dasel/releases/tag/v3.11.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6548","license":"OSV · upstream source license applies","key":"osv:GO-2026-6548","identifiers":["GO-2026-6548","CVE-2026-62866","GHSA-65gg-g7rw-6cpc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7696899+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7696907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-0cd050aa4e3407be88a99da87c4684cdd6e2bb2192e7b5d8516c5221fe2996c0","complete":true,"records":424321,"lastAttemptAt":"2026-11-11T21:56:53.6118096+00:00","lastSuccessAt":"2026-11-11T21:56:53.4062549+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.6118096+00:00","snapshotPublishedAt":"2026-11-11T21:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0211f24f7dd2479496f11922c7aad014","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T22:09:10.3527395+00:00","lastSuccessAt":"2026-11-11T22:09:09.323+00:00","error":"346 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T22:09:09.323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13257,"expectedIdentifiers":13813,"failedIdentifiers":346},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7704457+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7704461+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e103bc43c8e54398a828cba9bdd81bf5","complete":true,"records":13754,"lastAttemptAt":"2026-11-11T21:59:28.9840194+00:00","lastSuccessAt":"2026-11-11T21:59:28.981+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:59:28.981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T21:58:49.3669281+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.3669281+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T21:56:53.7926299+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.7926299+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T21:58:49.4873797+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.4873797+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T21:58:49.2338613+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.2338613+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}