CVE-2026-46377: Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Vulnerability summary

CVE-2026-46377 is a medium (CVSS 6.2) Improper Validation of Array Index vulnerability in tomwright dasel. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.5% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 16-07-2026
   Last modifiedVulnerability information updated.

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.