Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-62866 medium CVSS 6.2

Vulnerability in github.com/tomwright/dasel/v3 (CVE-2026-62866)

Summary

Vulnerability in github.com/tomwright/dasel/v3 (CVE-2026-62866). Risk of unauthorized operations or information disclosure. Exploitable via p.i. Mitigation: upgrade to 3.11.2 or later.

Original description

The description as published by the source.

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60.

The whitespace-skip loop right above (lines 55-57) advances p.i to p.srcLen when the input is all-whitespace or whitespace-trailing. The very next line reads p.src[p.i] without a bounds check.

Vulnerable code

selector/lexer/tokenize.go:53-74 (v3.11.0):

func (p *Tokenizer) parseCurRune() (Token, error) {
	// Skip over whitespace
	for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) {
		p.i++
	}

	// Skip over comments
	if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' {
		// ...

Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.

Reproduce

$ echo '{"a":1}' | dasel query -i json 'a '
panic: runtime error: index out of range [2] with length 2

goroutine 1 [running]:
github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...)
	selector/lexer/tokenize.go:60
github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...)
github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...)
github.com/tomwright/dasel/v3/selector.Parse(...)
github.com/tomwright/dasel/v3/execution.ExecuteSelector(...)

Other inputs that hit it: ' ', $'a\t', $'a\n', 'a ?? ', 'a + '. Any token (or no token) followed by whitespace.

Reachable…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-62866 has been found in github.com/tomwright/dasel/v3.
Attackers can target a specific entry point like p.i over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.2/10.
What to do: upgrade github.com/tomwright/dasel/v3 to 3.11.2 or later.
If unsure, ask your IT team or search "github.com/tomwright/dasel/v3 CVE-2026-62866" on the vendor's site.

CVE-2026-62866 (github.com/tomwright/dasel/v3) — CWE-129 / CVSS v3 6.2
Attack vector: local / unauthenticated / no user interaction
Attack surface: p.i / p.srcLen / main / parseCurRune
Patched: 3.11.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-129) exists in github.com/tomwright/dasel/v3. Attackers reach the vulnerable code path via p.i without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/tomwright/dasel/v3. Attack surface: p.i / p.srcLen / main / parseCurRune.

🔥 Severity

Severity: Medium (CVSS 6.2/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 3.11.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/tomwright/dasel/v3' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'github.com/tomwright/dasel/v3' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/tomwright/dasel/v3 を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade github.com/tomwright/dasel/v3 to 3.11.2

    ステージング環境で 3.11.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

go github.com/tomwright/dasel/v3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details