Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M
CVE-2026-35197Code injection in dye template expressions
Medium 6.6
In plain English
A medium-severity code injection in dye from mattieb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.3%top 76.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjr x_refsource_CONFIRM
- https://mattiebee.io/dye-template-advisory x_refsource_MISC