CVE-2026-46377

Name of the Vulnerable Software and Affected Versions dasel versions 3.0.0 through 3.3.1

Description The selector lexer contains a flaw that causes a process crash via a Go runtime panic when tokenizing a quoted string that ends with a trailing backslash. This occurs because the escape sequence handler in the parseCurRune() function fails to perform a bounds check after incrementing the position pointer, leading to an index-out-of-range error when the backslash is the final character of the input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.