Vulnerability Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tomwright | Dasel | >= 3.0.0, < 3.3.2 |
Related Weaknesses (CWE)
References
- https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-33320?
CVE-2026-33320 is a vulnerability with a CVSS score of 6.2 (MEDIUM). Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can...
How severe is CVE-2026-33320?
CVE-2026-33320 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33320?
Check the references section above for vendor advisories and patch information. Affected products include: Tomwright Dasel.