CVE-2026-35197

9.8 criticalEPSS 0.3%

Critical (9.8) in mattiebee dye. EPSS 0.3% chance of exploitation in the next 30 days.

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-04-06
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

mattiebee:dye

References

https://github.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjr
https://mattiebee.io/dye-template-advisory

Check your stack JSON