CVE-2026-59168

Name of the Vulnerable Software and Affected Versions Dasel versions 3.0.0 through 3.11.0

Description Dasel is a command-line tool and library for querying, modifying, and transforming data structures. The software fails to implement a depth guard when recursing per input nesting level within the decodeValue(), decodeObject(), and decodeArray() functions in parsing/json/json reader.go, as well as the parseElement() function in parsing/xml/reader.go. An attacker can provide deeply nested JSON or XML data through the command-line interface, the parse selector function, or by calling parsing.Format(...).NewReader(...).Read(data), which can exhaust the Go goroutine stack. This leads to an unrecoverable fatal error that terminates the entire process. The existing XML input-size limit does not prevent this depth exhaustion, and the failure cannot be intercepted by defer or recover mechanisms.

Recommendations Update to version 3.11.1.