External risk intelligence

Dye Template Expression Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-35197

dye is a library intended for use in shell scripts. Libraries are developer-facing components integrated into local scripts or build processes, not internet-facing services, gateways, or appliances that would typically be exposed to the public internet.

Code Injection

Mattiebee Dye

1.1.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the dye color library, used for shell scripts, could allow for arbitrary code execution if certain template expressions are used. This could potentially impact systems processing untrusted input through these scripts, though the library's intended use suggests limited direct external exposure.

Arbitrary code execution risk in scripts.
Matters for supply chain and developer tool integrity.
Confirm relevance and exposure for affected scripts.

Attack Path

How an attacker could exploit the issue

An attacker could trigger arbitrary code execution by providing specially crafted template expressions to the vulnerable dye library. This could occur if an attacker can influence the templates processed by a script using the library, leading to the execution of malicious commands on the system. The vulnerability stems from how certain template expressions are handled, allowing unintended code to be run.

No authentication or user interaction needed.
Malicious template expressions processed by dye.
Arbitrary code execution on the host system.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, certain dye template expressions could result in arbitrary code execution. This could affect the behavior of shell scripts and potentially allow for unauthorized code to run on systems where these scripts are executed.

Arbitrary code execution.
Malicious code injection via templates.
Script behavior could be altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

The dye library, used for shell scripts, has a vulnerability that allows for arbitrary code execution. This issue was fixed by the author and is not known to be exploited. Remediation requires identifying where dye is implemented, confirming its reachability and criticality, and then coordinating the fix with development or operations teams.

Application owners should prioritize assessment.
Verify dye's presence and usage scope.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the dye library and what is it used for?

Dye is a portable tool designed for shell scripts to manage color formatting. It acts as a library that developers integrate into their command-line environments to improve output readability. Because it is a library rather than a standalone application, it typically functions as a component within local development workflows, custom automation scripts, or build processes.

How does CVE-2026-35197 allow arbitrary code execution?

This vulnerability falls under the weakness class of Improper Control of Generation of Code (CWE-94). It occurs because the dye library does not properly sanitize certain template expressions before processing them. When the library encounters these specific, crafted expressions, it inadvertently executes them as commands, which can grant an attacker the ability to run unauthorized code on the host system.

When does a template expression trigger this vulnerability?

The flaw is triggered when the dye library processes untrusted or malicious input provided within a template expression. It does not activate during standard, expected usage where inputs are controlled or trusted. If your scripts only utilize hardcoded, static templates that do not incorporate external user-provided data, they would not be exposed to this specific trigger path.

Do I need to worry about this if my dye scripts are internal?

According to Halo Surface Signal, this library is primarily a developer-facing component integrated into local processes rather than an internet-facing service. While external exposure is classified as a potential concern, the actual risk depends on whether your internal scripts process inputs from untrusted sources. If a script is isolated and does not interact with public-facing data, the immediate likelihood of a remote exploit is very low.

Is there a way to fix the dye vulnerability?

Yes, the vulnerability is resolved in version 1.1.1. To address this, begin by conducting an inventory of your codebase to identify where the dye library is currently implemented. Once identified, coordinate with your development team to update the library to the patched version. This update should be part of your standard maintenance and deployment cycle for any software or scripts that rely on this library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.