This vulnerability arises from an injection flaw within dye template expressions, allowing an attacker to execute arbitrary shell commands when a vulnerable expression is evaluated. The weakness aligns with CWE‑94, enabling unauthorized code execution that can compromise confidentiality, integrity, and availability of the host environment. The reported CVSS score of 6.6 indicates moderate severity.

The dye color library produced by mattieb is affected. Any instance installed with a version earlier than 1.1.1 may be vulnerable if a dye expression is evaluated in a shell script.

The assigned severity (CVSS 6.6) reflects a moderate risk; EPSS information is unavailable, and the vulnerability is not listed in the KEV catalog. The likely attack vector is local or through scripts that process untrusted dye expressions. While there is no evidence of active exploitation, environments that execute user‑supplied or compromised scripts could be impacted if an attacker can influence the content of a dye expression.