{"id":"CVE-2026-62866","aliases":["DEBIAN-CVE-2026-62866","EUVD-2026-84016","GHSA-65gg-g7rw-6cpc","GO-2026-6548","UBUNTU-CVE-2026-62866"],"status":"published","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00192,"percentile":0.08944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2026-09-21T16:51:18Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"Go","package":"github.com/tomwright/dasel/v3","fixed_in":["3.11.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"dasel","fixed_in":["3.11.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/tomwright/dasel/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.11.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-1"}]}],"versions":["2.8.1-1","3.11.0-1","3.8.0-1","3.8.1-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/tomwright/dasel/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.11.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tomwright/dasel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tomwright/dasel/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tomwright/dasel/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.11.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.0-1build1","2.6.0-1ubuntu0.1","2.6.0-1ubuntu0.2","2.6.0-1ubuntu0.2+esm1","2.6.0-1ubuntu0.3","2.6.0-1ubuntu0.3+esm1","2.6.0-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1-1build1","3.11.0-1","3.11.2-1","3.11.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1-1","2.8.1-1build1"]}],"products":[{"vendor":"tomwright","product":"dasel"}],"references":[{"url":"https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/TomWright/dasel/releases/tag/v3.11.2","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62866","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-65gg-g7rw-6cpc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62866.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62866","tags":["advisory"]},{"url":"https://github.com/TomWright/dasel","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-62866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62866","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-62866","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T16:51:18.52Z","modified":"2026-09-21T18:00:18.178Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-84016","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T16:51:18Z","modified":"2026-09-21T18:00:18Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:05.032636Z"}],"ghsa":[{"id":"GHSA-65gg-g7rw-6cpc","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`.\n\nThe whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check.\n\n## Vulnerable code\n\n`selector/lexer/tokenize.go:53-74` (v3.11.0):\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\t// Skip over whitespace\n\tfor p.i \u003c p.srcLen \u0026\u0026 unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\t// Skip over comments\n\tif p.src[p.i] == '/' \u0026\u0026 p.i+1 \u003c p.srcLen \u0026\u0026 p.src[p.i+1] == '/' {\n\t\t// ...\n```\n\nLines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.\n\n## Reproduce\n\n```\n$ echo '{\"a\":1}' | dasel query -i json 'a '\npanic: runtime error: index out of range [2] with length 2\n\ngoroutine 1 [running]:\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...)\n\tselector/lexer/tokenize.go:60\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...)\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...)\ngithub.com/tomwright/dasel/v3/selector.Parse(...)\ngithub.com/tomwright/dasel/v3/execution.ExecuteSelector(...)\n```\n\nOther inputs that hit it: `'   '`, `$'a\\t'`, `$'a\\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace.\n\nReachable directly from the library too - `dasel.Query(ctx, input, \"a \")` panics the same way. Project-style test reproducer that fails on current `main`:\n\n```go\n// drop into selector/lexer/ as tokenize_trailing_ws_test.go\npackage lexer_test\n\nimport (\n\t\"testing\"\n\t\"github.com/tomwright/dasel/v3/selector/lexer\"\n)\n\nfunc TestTokenize_TrailingWhitespacePanic(t *testing.T) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Fatalf(\"Tokenize panicked: %v\", r)\n\t\t}\n\t}()\n\t_, _ = lexer.NewTokenizer(\"a \").Tokenize()\n}\n```\n\n## Impact\n\nProcess crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file.\n\n## Affected versions\n\nAll v3.x. The whitespace-skip loop was added in `78fcca9` (Dasel V3, ~9 months ago); line 60's indexing landed in `9bfe966` (~6 months ago). Reproduced on `github.com/tomwright/dasel/v3@v3.11.0`.\n\n## Suggested fix\n\nOne line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71:\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\tfor p.i \u003c p.srcLen \u0026\u0026 unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\tif p.i \u003e= p.srcLen {\n\t\treturn NewToken(EOF, \"\", p.i, 0), nil\n\t}\n\n\tif p.src[p.i] == '/' \u0026\u0026 p.i+1 \u003c p.srcLen \u0026\u0026 p.src[p.i+1] == '/' {\n```\n\n## Prevalence\n\nThe other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.","status":"published","published":"2026-09-22T19:52:16Z","modified":"2026-09-22T19:52:17Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-62866","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T17:17:38.053Z","modified":"2026-09-24T21:25:27.05Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-62866","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T16:51:18.52Z","modified":"2026-10-28T02:31:11.884676255Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62866","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T17:17:38.053Z","modified":"2026-09-25T08:47:28.120611648Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-65gg-g7rw-6cpc","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`","description":"Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`.\n\nThe whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check.\n\n## Vulnerable code\n\n`selector/lexer/tokenize.go:53-74` (v3.11.0):\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\t// Skip over whitespace\n\tfor p.i \u003c p.srcLen \u0026\u0026 unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\t// Skip over comments\n\tif p.src[p.i] == '/' \u0026\u0026 p.i+1 \u003c p.srcLen \u0026\u0026 p.src[p.i+1] == '/' {\n\t\t// ...\n```\n\nLines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it.\n\n## Reproduce\n\n```\n$ echo '{\"a\":1}' | dasel query -i json 'a '\npanic: runtime error: index out of range [2] with length 2\n\ngoroutine 1 [running]:\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...)\n\tselector/lexer/tokenize.go:60\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...)\ngithub.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...)\ngithub.com/tomwright/dasel/v3/selector.Parse(...)\ngithub.com/tomwright/dasel/v3/execution.ExecuteSelector(...)\n```\n\nOther inputs that hit it: `'   '`, `$'a\\t'`, `$'a\\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace.\n\nReachable directly from the library too - `dasel.Query(ctx, input, \"a \")` panics the same way. Project-style test reproducer that fails on current `main`:\n\n```go\n// drop into selector/lexer/ as tokenize_trailing_ws_test.go\npackage lexer_test\n\nimport (\n\t\"testing\"\n\t\"github.com/tomwright/dasel/v3/selector/lexer\"\n)\n\nfunc TestTokenize_TrailingWhitespacePanic(t *testing.T) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Fatalf(\"Tokenize panicked: %v\", r)\n\t\t}\n\t}()\n\t_, _ = lexer.NewTokenizer(\"a \").Tokenize()\n}\n```\n\n## Impact\n\nProcess crash, no auth, no preconditions. Same severity tier as the two May 13 advisories on this file.\n\n## Affected versions\n\nAll v3.x. The whitespace-skip loop was added in `78fcca9` (Dasel V3, ~9 months ago); line 60's indexing landed in `9bfe966` (~6 months ago). Reproduced on `github.com/tomwright/dasel/v3@v3.11.0`.\n\n## Suggested fix\n\nOne line, between the whitespace-skip loop and the comment-skip access. Same shape as lines 69-71:\n\n```go\nfunc (p *Tokenizer) parseCurRune() (Token, error) {\n\tfor p.i \u003c p.srcLen \u0026\u0026 unicode.IsSpace(rune(p.src[p.i])) {\n\t\tp.i++\n\t}\n\n\tif p.i \u003e= p.srcLen {\n\t\treturn NewToken(EOF, \"\", p.i, 0), nil\n\t}\n\n\tif p.src[p.i] == '/' \u0026\u0026 p.i+1 \u003c p.srcLen \u0026\u0026 p.src[p.i+1] == '/' {\n```\n\n## Prevalence\n\nThe other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.","status":"published","published":"2026-09-22T19:52:16Z","modified":"2026-10-01T20:55:58.390167711Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2026-62866","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.","status":"published","published":"2026-09-21T17:17:00Z","modified":"2026-10-17T13:00:31.192689425Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"GO-2026-6548","title":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel","description":"Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-01T20:45:12.227196328Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}