{"id":"CVE-2026-46377","summary":"Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string","details":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as \"\\ or '\\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.","aliases":["GHSA-m5j3-4634-c2vq","GO-2026-5491"],"modified":"2026-07-19T03:30:53.511469472Z","published":"2026-07-16T17:57:16.643Z","related":["CGA-9cwx-fxp3-82mc"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46377.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-129"]},"references":[{"type":"WEB","url":"https://github.com/TomWright/dasel/releases/tag/v3.10.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46377.json"},{"type":"ADVISORY","url":"https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46377"},{"type":"FIX","url":"https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tomwright/dasel","events":[{"introduced":"648f83baf070d9e00db8ff312febef857ec090a3"},{"fixed":"5fc1172287df89860caf139b146007d7ed12178c"},{"fixed":"e3c6663d78c62f69579d8f9afd00453dc3d01c29"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.10.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.10.0","v3.9.0","v3.8.1","v3.8.0","v3.7.0","v3.6.0","v3.5.0","v3.4.1","v3.4.0","v3.3.2","v3.3.1","v3.3.0","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46377.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}