CyberRota Analysis
AI-GeneratedThe vulnerability affects Dasel versions 3.0.0 to 3.10.1, where an attacker can exploit an unterminated regex literal in selector strings, leading to a denial-of-service condition by causing excessive CPU consumption. Organizations using Dasel for data manipulation should prioritize upgrading to version 3.10.1 to mitigate this risk. This issue is particularly relevant for environments where Dasel is integrated into automated workflows or processing pipelines.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.