CVE-2026-35197 is a code injection flaw in dye, a color library for shell scripts, scored 6.6 (Medium) in the CVE record. Certain template expressions in dye 1.1.0 can run arbitrary code. The author fixed it in 1.1.1 and says the issue is not known to be exploited.
What's affected
- Product: dye (mattieb/dye), a portable color library for shell scripts
- Affected version: 1.1.0, where template support first appeared. The record says "prior to 1.1.1"
- Fixed version: 1.1.1
- Attack vector in the CVSS vector: local, with user interaction required
The author's advisory says the issue was found and fixed by the author and is not known to be exploited. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
dye is a shell library, so it lives inside your scripts rather than in a package manager. Look for where it is sourced or installed and which version that copy is.
command -v dye
grep -rIn "dye" --include="*.sh" .
Then look for scripts that use dye's template feature, which wraps commands in double curly braces inside a string. The risk exists only if untrusted text, such as a file name or user input, can end up inside such a template. Scripts that never use templates are not exposed to this flaw.
What to do now
- Update dye to 1.1.1 or later everywhere it is vendored or installed.
- Find scripts that pass file names, environment values or user input into dye templates.
- If you cannot upgrade yet, do not insert untrusted content into dye template expressions, or avoid template expressions. That is the author's workaround.
- Record the dye version in the script repository so the next update is easy to spot.
Why it matters
The author explains that template support was built by taking the text between double curly braces and running it as if it were a dye command. Internally, one step used the shell builtin eval to call tput. Combined with templates, that allowed command text inside the braces to be interpreted by the shell. The fix removed all use of eval and splits the arguments explicitly.
The record classes this as CWE-94, code injection. The score is moderate because the attack is local and needs a user to run a script that handles attacker-influenced text. Shell scripts that process file names from shared folders are the realistic place to look, because a file name is easy for someone else to choose.
Quick check
Is dye exploited in the wild?
The author says the issue is not known to be exploited, and the CVE is not in the CISA catalog.
Does this affect scripts that use dye without templates?
The advisory ties the flaw to template expressions. Upgrading to 1.1.1 is still the clean answer, since the fix removes the unsafe eval calls.
Sources
- CVE record for CVE-2026-35197 on Gold
- GitHub advisory GHSA-3v4r-5vfh-3wjr
- Author write-up: dye template injection
Last reviewed: 19 October 2026.
