Executive brief
The 'cut' utility in uutils coreutils, a Rust-based implementation of standard Unix command-line tools, contains a logic error when processing files. When a user attempts to filter out lines that do not contain a specific separator (using the -s or --only-delimited flag) while using a newline as the separator, the tool fails to suppress those lines. This can cause automated scripts or data processing pipelines to receive unexpected data, potentially leading to incorrect operations or downstream errors.
Technical details
A logic error exists in the `cut_fields_newline_char_delim` function of the `uu_cut` crate within uutils coreutils. The implementation fails to check the `only_delimited` flag when a newline is used as the delimiter, causing the utility to print lines that do not contain the delimiter instead of suppressing them as required by the `-s` option. This is classified as an Always-Incorrect Control Flow Implementation (CWE-670). An attacker with local access could potentially leverage this to bypass strict output filtering in scripts that rely on `cut` for data sanitization or parsing. The issue was fixed in version 0.7.0 by adding the missing flag verification and optimizing the field-level streaming logic.
Affected products
- uutils coreutils uu_cut < 0.7.0
Timeline
- 2026-01: disclosed: Reported in Zellic uutils coreutils Program Security Assessment
- 2026-03-04: patched: Fix merged into main branch
- 2026-05-30: advisory: GitHub Advisory published
- 2026-07-06: advisory: Advisory reviewed and updated
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-wv33-5pxh-r7j7
- https://github.com/uutils/coreutils/pull/11143
- https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
- https://github.com/uutils/coreutils/releases/tag/0.7.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-wv33-5pxh-r7j7