PT-2026-30721 · Dye · Dye

Mattieb · CVE-2026-35197 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dye versions prior to 1.1.1

Description dye, a color library for shell scripts, had a flaw where specific template expressions could lead to the execution of arbitrary code. This issue was identified and addressed by the software's author and is not known to have been exploited.

Recommendations Update to version 1.1.1 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-35197

GHSA-3V4R-5VFH-3WJR

Affected Products

Dye

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35197.json · Exploit
• https://github.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35197 · Security Note
• https://mattiebee.io/dye-template-advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35197 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041250713456554293 · Twitter Post