An index-out-of-range vulnerability in the Dasel library, version 3.0.0 through 3.11.1, could allow an unauthenticated attacker to cause a denial of service by triggering a process panic.

The vulnerability exists in the selector/lexer/tokenize.go file, where the parseCurRune function fails to perform an end-of-input check after advancing the index past trailing whitespace. This flaw allows an unauthenticated attacker to trigger an index-out-of-range panic when providing a malformed query, resulting in an immediate process crash.

While the CVSS score is 6.2, this vulnerability represents a significant risk to availability for systems that utilize Dasel for automated data transformation or query processing. A successful exploit causes an immediate application crash, leading to service disruption or potential failure of automated pipelines relying on the tool.

Immediate Action: Update the Dasel library to version 3.11.2 or later to include the necessary input validation fix.

Proactive Monitoring: Review application logs for unexpected process terminations or crash reports originating from Dasel components.

Compensating Controls: Implement input sanitization routines in wrappers that pass user-supplied input to Dasel to ensure queries do not contain trailing whitespace or malformed selector structures.

Public Exploit Available: Unknown

Organizations utilizing Dasel within their infrastructure should prioritize updating to version 3.11.2 immediately. Given the availability of proof-of-concept data, failure to patch may expose critical automated processes to denial-of-service attacks.