uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
CVE-2026-35380 is a logic error vulnerability in the cut utility of uutils coreutils prior to version 0.8.0. The utility incorrectly treats the two-byte string of two single quotes ('') as an empty delimiter, mapping it to the NUL character for both the -d and --output-delimiter options. This can cause silent data corruption or logic errors in automated scripts and data pipelines that rely on literal delimiters, as the utility may split or join data on NUL bytes instead of the intended characters. The issue is fixed in version 0.8.0.
A logic error in the expr utility of uutils coreutils causes it to evaluate parenthesized subexpressions during parsing rather than execution, preventing proper short-circuit evaluation of logical OR and AND operations. This can cause arithmetic errors in branches that should be ignored, such as division by zero, resulting in fatal errors and premature termination of shell scripts that rely on GNU expr behavior.
A logic error in the tr utility of uutils coreutils incorrectly defines the [:graph:] and [:print:] character classes by including the ASCII space in [:graph:] and excluding it from [:print:]. This reverses the expected POSIX and GNU coreutils behavior, potentially causing unintended data modification or loss in automated scripts or data-cleaning pipelines that rely on these character classes.
CVE-2026-35377 is a logic error in the env utility of uutils coreutils that causes improper input validation when using the -S (split-string) option. The utility incorrectly rejects valid escape sequences that GNU env accepts, resulting in an 'invalid sequence' error and process termination with exit status 125. This behavior breaks compatibility with scripts relying on standard split-string semantics, causing a local denial of service.
CVE-2026-35376 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the chcon utility of uutils coreutils during recursive operations. It arises because recursive target resolution uses fresh path lookups instead of binding traversal and label application to a consistent directory state. This allows a local attacker with write access to exploit timing-sensitive rename or symbolic link races to redirect privileged recursive relabeling to unintended files or directories, potentially modifying SELinux security labels on sensitive system objects.
A logic error in the split utility of uutils coreutils causes output filename corruption when non-UTF-8 prefix or suffix inputs are used. The utility uses to_string_lossy(), which replaces invalid byte sequences with the UTF-8 replacement character, unlike GNU split which preserves raw bytes. This can lead to incorrect filenames, causing filename collisions, broken automation, or misdirected output data in non-UTF-8 environments. The issue affects versions before 0.8.0 and has a low severity rating. A fix is available in version 0.8.0.
A TOCTOU race condition exists in the split utility of uutils coreutils (CVE-2026-35374). The utility checks for identity between input and output file paths before splitting, but then opens the output file with truncation after this check. A local attacker with write access to the directory can exploit this race window by manipulating path components, causing unintended truncation and data loss.
A logic error in the ln utility of uutils coreutils causes it to dereference symbolic links even when the --no-dereference (-n) flag is used without --force. This leads to new links being created inside the target directory of the symlink rather than on the symlink itself. A local attacker could exploit this to redirect file creation into sensitive directories, potentially causing unauthorized file creation or system misconfiguration. The issue affects versions prior to 0.8.0 and has been fixed in version 0.8.0.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-jcjr-rh8q-7xqf. This link is maintained to preserve external references.
### Original Description
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xv5w-cw7x-72gj. This link is maintained to preserve external references.
### Original Description
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-47c7-qrm7-mqw7. This link is maintained to preserve external references.
### Original Description
The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pmfc-4wjj-gmhx. This link is maintained to preserve external references.
### Original Description
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.
A TOCTOU race condition exists in the mkfifo utility of uutils coreutils (CVE-2026-35352). The utility creates a FIFO and then changes its permissions using chmod. A local attacker with write access to the parent directory can replace the FIFO with a symbolic link between creation and chmod, causing chmod to affect an arbitrary file. This can lead to privilege escalation if mkfifo is run with elevated privileges.
The nohup utility in uutils coreutils creates its default output file nohup.out with permissions that are not explicitly restricted, typically resulting in a world-readable file (0644). This can expose the stdout/stderr output of commands to other users on a multi-user system, potentially leaking sensitive information. This differs from GNU coreutils, which restricts nohup.out to owner-only permissions (0600).
CVE-2026-35368 is a vulnerability in the chroot utility of uutils coreutils (versions up to 0.8.0) when using the --userspec option. The issue arises because the utility resolves user specifications via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this triggers the Name Service Switch (NSS) to load shared libraries from the new root directory. If the new root directory is writable by an attacker, they can inject a malicious NSS module, leading to arbitrary code execution as root. This can enable full container escape or privilege escalation.
A TOCTOU race condition exists in the mv utility of uutils coreutils during cross-device moves. A local attacker with write access to the destination directory can exploit a timing window to replace the destination with a symbolic link, causing the move operation to overwrite an arbitrary file. This affects versions up to 0.8.0 and has a medium severity rating with CVSS 6.3.
The touch utility in uutils coreutils versions up to 0.8.0 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. This flaw allows an attacker to exploit a timing window between the utility checking for a file's existence and creating it, potentially causing truncation of an existing file and resulting in permanent data loss.
CVE-2026-35359 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils. It allows an attacker with concurrent write access to bypass the intended no-dereference protection on symbolic links. The vulnerability arises because the utility checks if a source path is a symbolic link using metadata but then opens the path without the O_NOFOLLOW flag, enabling a race condition. This can lead to copying contents of arbitrary sensitive files to attacker-controlled destinations.
A race condition vulnerability exists in the cp utility of uutils coreutils (CVE-2026-35357). During file copying, destination files are initially created with default permissions before being restricted to their final mode. A local attacker can exploit this timing window to open and read the file descriptor before permissions are tightened, potentially exposing sensitive file contents.