Nixpkgs security tracker
Permalink
CVE-2026-35197
6.6 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): NONE
Code injection in dye template expressions
dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.
References
-
https://github.com/mattieb/dye/security/advisories/GHSA-3v4r-5vfh-3wjr x_refsource_CONFIRM
-
https://mattiebee.io/dye-template-advisory x_refsource_MISC
Affected products
dye
- ==< 1.1.1
Matching in nixpkgs
pkgs.andyetitmoves
Physics/Gravity Platform game
pkgs.haskellPackages.dyepack
Programatically identify space leaks in your program
pkgs.python312Packages.tidyexc
Raise rich, helpful exceptions
pkgs.python313Packages.tidyexc
Raise rich, helpful exceptions
pkgs.python314Packages.tidyexc
Raise rich, helpful exceptions
Package maintainers
-
@jpetrucciani Jacobi Petrucciani <j@cobi.dev>