Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by tomwright
CVE-2026-62866 (GCVE-0-2026-62866)
Vulnerability from nvd – Published: 2026-09-21 16:51 – Updated: 2026-09-21 18:00
VLAI
EPSS
VEX
Title
Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:59 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/eee03ae… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.11.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:59:52.863215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:00:18.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:55:00.169Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc"
},
{
"name": "https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.11.2"
}
],
"source": {
"advisory": "GHSA-65gg-g7rw-6cpc",
"discovery": "UNKNOWN"
},
"title": "Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62866",
"datePublished": "2026-09-21T16:51:18.520Z",
"dateReserved": "2026-07-14T21:10:50.032Z",
"dateUpdated": "2026-09-21T18:00:18.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59168 (GCVE-0-2026-59168)
Vulnerability from nvd – Published: 2026-09-21 16:55 – Updated: 2026-09-21 20:45
VLAI
EPSS
VEX
Title
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/4c91d0d… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.11.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:35.532900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:45:17.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:55:07.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq"
},
{
"name": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.11.1"
}
],
"source": {
"advisory": "GHSA-cqxr-jxr2-85pq",
"discovery": "UNKNOWN"
},
"title": "Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59168",
"datePublished": "2026-09-21T16:55:07.859Z",
"dateReserved": "2026-07-02T16:50:27.887Z",
"dateUpdated": "2026-09-21T20:45:17.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46378 (GCVE-0-2026-46378)
Vulnerability from nvd – Published: 2026-07-16 17:54 – Updated: 2026-07-17 15:06
VLAI
EPSS
VEX
Title
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 15:06 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/95f8dd3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46378",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T15:06:25.761486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T15:06:49.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:57:33.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64"
},
{
"name": "https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed"
}
],
"source": {
"advisory": "GHSA-m6xr-fvfg-5g64",
"discovery": "UNKNOWN"
},
"title": "Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46378",
"datePublished": "2026-07-16T17:54:51.705Z",
"dateReserved": "2026-05-13T19:53:47.921Z",
"dateUpdated": "2026-07-17T15:06:49.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46377 (GCVE-0-2026-46377)
Vulnerability from nvd – Published: 2026-07-16 17:57 – Updated: 2026-07-16 18:21
VLAI
EPSS
VEX
Title
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 18:21 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/5fc1172… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.10.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46377",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:21:25.556634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:21:45.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or \u0027\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:57:16.643Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"
},
{
"name": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.10.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.10.1"
}
],
"source": {
"advisory": "GHSA-m5j3-4634-c2vq",
"discovery": "UNKNOWN"
},
"title": "Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46377",
"datePublished": "2026-07-16T17:57:16.643Z",
"dateReserved": "2026-05-13T19:53:47.921Z",
"dateUpdated": "2026-07-16T18:21:45.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33320 (GCVE-0-2026-33320)
Vulnerability from nvd – Published: 2026-03-24 00:06 – Updated: 2026-03-26 12:24
VLAI
EPSS
VEX
Title
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-26 12:24 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33320",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-26T12:24:19.541190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T12:24:32.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel\u0027s YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library\u0027s own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4\u0027s built-in alias expansion limit. Version 3.3.2 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T00:06:22.351Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8"
}
],
"source": {
"advisory": "GHSA-4fcp-jxh7-23x8",
"discovery": "UNKNOWN"
},
"title": "Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33320",
"datePublished": "2026-03-24T00:06:22.351Z",
"dateReserved": "2026-03-18T21:23:36.677Z",
"dateUpdated": "2026-03-26T12:24:32.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59168 (GCVE-0-2026-59168)
Vulnerability from cvelistv5 – Published: 2026-09-21 16:55 – Updated: 2026-09-21 20:45
VLAI
EPSS
VEX
Title
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/4c91d0d… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.11.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:35.532900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:45:17.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:55:07.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq"
},
{
"name": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.11.1"
}
],
"source": {
"advisory": "GHSA-cqxr-jxr2-85pq",
"discovery": "UNKNOWN"
},
"title": "Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59168",
"datePublished": "2026-09-21T16:55:07.859Z",
"dateReserved": "2026-07-02T16:50:27.887Z",
"dateUpdated": "2026-09-21T20:45:17.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62866 (GCVE-0-2026-62866)
Vulnerability from cvelistv5 – Published: 2026-09-21 16:51 – Updated: 2026-09-21 18:00
VLAI
EPSS
VEX
Title
Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:59 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/eee03ae… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.11.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:59:52.863215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:00:18.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:55:00.169Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-65gg-g7rw-6cpc"
},
{
"name": "https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/eee03aec28d4a33d6138098d065b7b37b85e3c55"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.11.2"
}
],
"source": {
"advisory": "GHSA-65gg-g7rw-6cpc",
"discovery": "UNKNOWN"
},
"title": "Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62866",
"datePublished": "2026-09-21T16:51:18.520Z",
"dateReserved": "2026-07-14T21:10:50.032Z",
"dateUpdated": "2026-09-21T18:00:18.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46377 (GCVE-0-2026-46377)
Vulnerability from cvelistv5 – Published: 2026-07-16 17:57 – Updated: 2026-07-16 18:21
VLAI
EPSS
VEX
Title
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 18:21 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/5fc1172… | x_refsource_MISC |
| https://github.com/TomWright/dasel/releases/tag/v3.10.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46377",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:21:25.556634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:21:45.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or \u0027\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:57:16.643Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"
},
{
"name": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c"
},
{
"name": "https://github.com/TomWright/dasel/releases/tag/v3.10.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/releases/tag/v3.10.1"
}
],
"source": {
"advisory": "GHSA-m5j3-4634-c2vq",
"discovery": "UNKNOWN"
},
"title": "Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46377",
"datePublished": "2026-07-16T17:57:16.643Z",
"dateReserved": "2026-05-13T19:53:47.921Z",
"dateUpdated": "2026-07-16T18:21:45.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46378 (GCVE-0-2026-46378)
Vulnerability from cvelistv5 – Published: 2026-07-16 17:54 – Updated: 2026-07-17 15:06
VLAI
EPSS
VEX
Title
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 15:06 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
| https://github.com/TomWright/dasel/commit/95f8dd3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46378",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T15:06:25.761486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T15:06:49.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:57:33.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64"
},
{
"name": "https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TomWright/dasel/commit/95f8dd3af12958bf6ca2a737b3ec0267280f86ed"
}
],
"source": {
"advisory": "GHSA-m6xr-fvfg-5g64",
"discovery": "UNKNOWN"
},
"title": "Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46378",
"datePublished": "2026-07-16T17:54:51.705Z",
"dateReserved": "2026-05-13T19:53:47.921Z",
"dateUpdated": "2026-07-17T15:06:49.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33320 (GCVE-0-2026-33320)
Vulnerability from cvelistv5 – Published: 2026-03-24 00:06 – Updated: 2026-03-26 12:24
VLAI
EPSS
VEX
Title
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-26 12:24 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/TomWright/dasel/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33320",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-26T12:24:19.541190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T12:24:32.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dasel",
"vendor": "TomWright",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel\u0027s YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library\u0027s own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4\u0027s built-in alias expansion limit. Version 3.3.2 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T00:06:22.351Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8"
}
],
"source": {
"advisory": "GHSA-4fcp-jxh7-23x8",
"discovery": "UNKNOWN"
},
"title": "Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33320",
"datePublished": "2026-03-24T00:06:22.351Z",
"dateReserved": "2026-03-18T21:23:36.677Z",
"dateUpdated": "2026-03-26T12:24:32.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}