GHSA-FQF6-GXHH-2XHW uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

determinebackupmode in src/uucore/src/lib/features/backupcontrol.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone defaulting to existing/numbered, or $VERSIONCONTROL. Affects cp, install, mv, ln which share th...

EUVD-2026-25038

cut: -s ignored in -z -d '' newline-delimiter mode...

GHSA-P7H3-7Q52-72W8 printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

GHSA-W6XC-G9QJ-VP32 uucore: safe_traversal TOCTOU protection only enabled on Linux

The safetraversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use TOCTOU symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize...

EUVD-2026-24981

rm: --preserve-root bypassed via a symlink to / string check instead of dev/inode...

GHSA-WV33-5PXH-R7J7 cut: -s (only-delimited) ignored when delimiter is a newline

The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...

GHSA-6GCW-W7CP-94G9 comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...

EUVD-2026-24978

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output...

GHSA-2W8R-9XJ7-69J5 mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the...

EUVD-2026-24971

mktemp: empty TMPDIR creates temp files in CWD instead of /tmp...

EUVD-2026-24965

chmod: recursive mode returns exit code 0 even when some files fail last-file-wins...

EUVD-2026-24963

chmod: --preserve-root bypassed by any path that resolves to root e.g. /../...

CVE-2026-35376 vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-MH5C-XRMH-M794 vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-6G8R-74QP-6859 vulnerabilities

Vulnerabilities for packages: uutils...

CVE-2026-35368 vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-6G8R-74QP-6859 vulnerabilities

Vulnerabilities for packages: uutils...

CVE-2026-35368 vulnerabilities

Vulnerabilities for packages: uutils...

CVE-2026-35376 vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-MH5C-XRMH-M794 vulnerabilities

Vulnerabilities for packages: uutils...