by Kastro
Paper/Archive/CVE-2026-35197

CVE-2026-35197

mattieb dye — Code injection in dye template expressions

EPSS 0.3%public exploitCVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 21.7.217 × 204.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.

Affected

ProductAffectedFixed inSource
dye< 1.1.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjrrefmattiebee.io/dye-template-advisory