CVE-2026-46378

Name of the Vulnerable Software and Affected Versions dasel versions 3.0.0 through 3.3.1

Description The selector lexer contains a flaw that leads to a non-terminating loop when tokenizing an unterminated regex pattern, such as r/. This occurs because the matchRegexPattern closure within the parseCurRune() function fails to perform an end-of-input check while searching for the closing forward slash. Consequently, if the closing slash is missing, the tokenizer continues to increment the position index indefinitely, resulting in 100% CPU consumption on a single core and a denial of service. This issue can be triggered by a minimal 2-byte input of r/.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.