« Volver al listado

CVE-2026-33320

Estado: AnalizadaMedia (6.2)—

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tomwright — Dasel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33320",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33320",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-26T12:24:19.541190Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "TomWright",
          "product": "dasel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.3.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-24T01:17:02.203",
  "references": [
    {
      "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue."
    },
    {
      "lang": "es",
      "value": "Dasel es una herramienta de línea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. A partir de la versión 3.0.0 y antes de la versión 3.3.1, el lector YAML de Dasel permite a un atacante que puede proporcionar YAML para su procesamiento desencadenar un consumo extremo de CPU y memoria. El problema reside en la propia implementación `UnmarshalYAML` de la biblioteca, que resuelve manualmente los nodos alias siguiendo recursivamente los punteros `yaml.Node.Alias` sin ningún presupuesto de expansión, eludiendo el límite de expansión de alias incorporado de go-yaml v4. La versión 3.3.2 contiene un parche para el problema."
    }
  ],
  "lastModified": "2026-06-17T10:37:19.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tomwright:dasel:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E08D6137-BA75-4A33-9DAF-F28A5FCEF5DC",
              "versionEndExcluding": "3.3.2",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}