CyberRota Analysis
AI-GeneratedDasel versions 3.0.0 to 3.10.1 contain a vulnerability in the escape sequence handler that can lead to an index-out-of-range panic due to insufficient bounds checking when processing attacker-controlled selector strings. This flaw could potentially disrupt applications relying on Dasel for data manipulation, making it a concern for developers and organizations using this tool. Users of affected versions should prioritize upgrading to version 3.10.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.