CVE-2026-35197

BRIEFING NOTE: CVE-2026-35197 OVERVIEW CVE-2026-35197 affects dye, a color library used in shell scripts, in versions prior to 1.1.1. The vulnerability exists in certain template expressions within the library that allow arbitrary code execution. While the issue was identified and patched by dye's author, the vulnerability represents a significant risk to any systems utilizing affected versions of this library. SEVERITY This vulnerability carries a CRITICAL CVSS v3.1 score of 9.8, reflecting severe potential impact. The attack vector is network-based with low complexity, requiring no user interaction or special privileges. An unauthenticated attacker could potentially achieve complete system compromise, including confidentiality breach, integrity violation, and availability disruption. The FAUCET Risk Score of 55.0 indicates moderate organizational risk prioritization. EXPLOITATION STATUS Currently, no known active exploitation has been reported, and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. However, the vulnerability maintains active status on threat tracking lists, and exploit code availability cannot be definitively ruled out. Organizations should prioritize immediate patching to version 1.1.1 despite the absence of confirmed in-the-wild exploitation, given the critical severity and execution risk profile.