Most recent entries from all

fkie_cve-2026-62866

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

GHSA-65gg-g7rw-6cpc — Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Affected: Go: github.com/tomwright/dasel/v3

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`.

The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check.

## Vulnerable code

`selector/lexer/tokenize.go:53-74` (v3.11.0):

```go func (p *Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ }

// Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ... ```

Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.

## Reproduce

``` $ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2

goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...) ```

Other inputs that hit it: `' '`, `$'a\t'`, `$'a\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace.

Reachable…

UBUNTU-CVE-2026-62866

Affected: Ubuntu:Pro:24.04:LTS: dasel, Ubuntu:26.04:LTS: dasel