CVE-2026-46377

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46377", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T19:53:47.921Z", "datePublished": "2026-07-16T17:57:16.643Z", "dateUpdated": "2026-07-16T18:21:45.505Z"}, "containers": {"cna": {"title": "Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"}, {"name": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c", "tags": ["x_refsource_MISC"], "url": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c"}, {"name": "https://github.com/TomWright/dasel/releases/tag/v3.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/TomWright/dasel/releases/tag/v3.10.1"}], "affected": [{"vendor": "TomWright", "product": "dasel", "versions": [{"version": ">= 3.0.0, < 3.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T17:57:16.643Z"}, "descriptions": [{"lang": "en", "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or '\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."}], "source": {"advisory": "GHSA-m5j3-4634-c2vq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-16T18:21:25.556634Z", "id": "CVE-2026-46377", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T18:21:45.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46377", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T18:21:25.556634Z"}}}], "references": [{"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T18:21:41.589Z"}}], "cna": {"title": "Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string", "source": {"advisory": "GHSA-m5j3-4634-c2vq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "TomWright", "product": "dasel", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.10.1"}]}], "references": [{"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "name": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c", "name": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TomWright/dasel/releases/tag/v3.10.1", "name": "https://github.com/TomWright/dasel/releases/tag/v3.10.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or '\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T17:57:16.643Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46377", "state": "PUBLISHED", "dateUpdated": "2026-07-16T18:21:45.505Z", "dateReserved": "2026-05-13T19:53:47.921Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T17:57:16.643Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dasel", "vendor": "TomWright", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.10.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or '\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1."}, {"lang": "es", "value": "Dasel es una herramienta de l\u00ednea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. Desde la versi\u00f3n 3.0.0 hasta la 3.10.1, el gestor de secuencias de escape en (Tokenizer).parseCurRune en selector/lexer/tokenize.go incrementa m\u00e1s all\u00e1 de una barra invertida final en una cadena entrecomillada como \u2019\\\u2019 o \u2019\\\u2019 y luego lee p.src[pos] sin una comprobaci\u00f3n de l\u00edmites, permitiendo que cadenas de selector controladas por el atacante activen un p\u00e1nico de Go por \u00edndice fuera de rango. Este problema est\u00e1 solucionado en la versi\u00f3n 3.10.1."}], "id": "CVE-2026-46377", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46377", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T18:21:25.556634Z", "version": "2.0.3"}}]}, "published": "2026-07-16T19:16:46.127", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c"}, {"source": "security-advisories@github.com", "url": "https://github.com/TomWright/dasel/releases/tag/v3.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.10.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dasel", "source": "cna", "vendor": "TomWright"}, "product": "dasel", "vendor": "tomwright"}], "created": "2026-07-16T20:00:05.791611+00:00", "updated": "2026-07-31T01:45:06.881707+00:00", "vendors": ["tomwright", "tomwright$PRODUCT$dasel"]}