CVE-2026-35197

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35197

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35197.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35197

Aliases

GHSA-3v4r-5vfh-3wjr

Published

2026-04-06T19:39:23.095Z

Modified

2026-08-04T11:50:31.573104246Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Code injection in dye template expressions

Details

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35197.json"
}

References

Affected packages

Git / github.com/mattieb/dye

Affected ranges

Type

GIT

Repo

https://github.com/mattieb/dye

Events

Introduced

Fixed

462289b05f0b0001e3f6b6687669aa68d238fbd0

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*

v1.0.0

v1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35197.json"