CVE-2026-35197CWE-94

Code injection in dye template expressions

Medium · published April 6, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-06T19:39Z
EPSS history
Timeline
  • 06 APR 19:39Z
    Code injection in dye template expressions
    cvelistv5