CVE-2026-46378: Loop with Unreachable Exit Condition

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to an infinite loop in the selector lexer process when handling an unterminated regex literal. An attacker can cause the application to become unresponsive by providing specially crafted input that triggers the infinit...

EUVD-2025-18116

Malicious code in bioql PyPI...

GHSA-V33J-V3X4-42QG Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...