Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Source published

21 Sep 2026 16:51:18 UTC

Source modified

21 Sep 2026 18:00:18 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Source published

Sep 21, 2026, 4:51:18 PM (timezone not stated)

Source modified

Sep 21, 2026, 6:00:18 PM (timezone not stated)

Observed here

11 Nov 2026 15:05:09 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Source published

21 Sep 2026 17:17:38 UTC

Source modified

24 Sep 2026 21:25:27 UTC

Observed here

25 Oct 2026 14:19:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`. The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check. ## Vulnerable code `selector/lexer/tokenize.go:53-74` (v3.11.0): ```go func (p *Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ } // Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ... ``` Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it. ## Reproduce ``` $ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2 goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...) ``` Other inputs that hit it: `' '`, `$'a\t'`, `$'a\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace. Reachable directly from the library too - `dasel.Query(ctx, input, "a ")` panics the same way. Project-style test reproducer that fails on current `main`: ```go // drop into selector/lexer/ as tokenize_trailing_ws_test.go package lexer_test import ( "testing" "github.com/tomwright/dasel/v3/selector/lexer" ) func TestTokenize_TrailingWhitespacePanic(t *testing.T) { defer func() { if r := recover(); r != nil { t.Fatalf("Tokenize panicked: %v", r) } }() _, _ = lexer.NewTokenizer("a ").Tokenize() } ``` ## Impact Process crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file. ## Affected versions All v3.x. The whitespace-skip loop was added in `78fcca9` (Dasel V3, ~9 months ago); line 60's indexing landed in `9bfe966` (~6 months ago). Reproduced on `github.com/tomwright/dasel/[email protected]`. ## Suggested fix One line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71: ```go func (p *Tokenizer) parseCurRune() (Token, error) { for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ } if p.i >= p.srcLen { return NewToken(EOF, "", p.i, 0), nil } if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { ``` ## Prevalence The other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.

Source published

22 Sep 2026 19:52:16 UTC

Source modified

1 Oct 2026 20:55:58 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · MODERATE

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel

Source published

1 Oct 2026 20:23:38 UTC

Source modified

1 Oct 2026 20:45:12 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.