Live › vulnerability › CVE-2026-62866
Go to dashboardDasel, a Go library and CLI for querying data structures, panics when a selector ends in trailing whitespace. An attacker who controls the selector string can crash the process that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/tomwright/dasel | go | all versions | – |
| github.com/tomwright/dasel/v2 | go | all versions | – |
| github.com/tomwright/dasel/v3 | go | >= 3.0.0, < 3.11.2 | 3.11.2 |
Run go list -m github.com/tomwright/dasel/v3 and confirm the version is below 3.11.2.
Search the code for imports of github.com/tomwright/dasel or lexer.NewTokenizer/dasel.Query that take user-supplied selectors.
3.11.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-62866")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.