CVE-2026-62866

Name of the Vulnerable Software and Affected Versions Dasel versions 3.0.0 through 3.11.1

Description In the parseCurRune function within selector/lexer/tokenize.go, the input index advances across trailing whitespace and reads the source at the exhausted index without performing an end-of-input check. A selector ending in whitespace, when processed via lexer.NewTokenizer(...).Tokenize() or dasel.Query, can trigger an index-out-of-range panic, leading to process termination.

Recommendations Update to version 3.11.2.