PT-2026-30721 · Dye · Dye

Mattieb · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35197

Positive Technologies · (AI Summary)

CVSS v3.1

6.6

Medium

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions dye versions prior to 1.1.1

Description dye, a color library for shell scripts, had a flaw where specific template expressions could lead to the execution of arbitrary code. This issue was identified and addressed by the software's author and is not known to have been exploited.

Recommendations Update to version 1.1.1 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-35197

Affected Products

Dye

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35197 · Security Note
• https://github.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjr · Note
• https://mattiebee.io/dye-template-advisory · Note
• https://twitter.com/CVEnew/status/2041250713456554293 · Twitter Post