CVE-2026-35355: uutils coreutils TOCTOU symlink race in install utility

CVE-2026-35355 · Severity: medium · CVSS 6.3 · Published 2026-04-22

The 'install' utility in the uutils coreutils package (a Rust-based alternative to standard Linux command-line tools) contains a flaw in how it handles file replacements. A local attacker can exploit a brief timing window during the installation process to trick the utility into overwriting sensitive system files instead of the intended target. This could allow an attacker to gain elevated privileges or cause system instability by corrupting critical files like password databases.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35355 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35355 being exploited in the wild.
How severe is CVE-2026-35355?
Medium severity, with a CVSS score of 6.3, published 22 April 2026.
Which products and versions are affected?
uu_install (crates.io) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0; Uutils Install < 0.6.0.
Is there a fix for CVE-2026-35355?
Yes. uu_install (crates.io): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35355 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35355?
Check whether you run uu_install (crates.io), Uutils Coreutils or Uutils Install at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_install (crates.io): upgrade to 0.6.0 or later
    cargo update -p uu_install

Technical details

A TOCTOU symlink race exists in `copy_file` within `install/src/install.rs`. The utility unlinks a destination file and subsequently recreates it using path-based operations (`File::create` / `fs::copy`) without the `O_EXCL` flag. A local attacker with write access to the destination directory can insert a symbolic link during the window between the unlink and the recreation. If the `install` process is running with elevated privileges (e.g., during a system build or staging process), the write is redirected to the symlink target, enabling the overwrite of arbitrary files such as `/etc/passwd`. The vulnerability is fixed in version 0.6.0 by using atomic file creation with `O_EXCL`.

Affected products

  • uutils uu_install < 0.6.0

Identifiers

  • CVE-2026-35355
  • GHSA-239g-2685-54x3

Timeline

  • 2026-01-05: other: Pull request submitted to fix the vulnerability
  • 2026-01-17: patched: Fix merged into main branch
  • 2026-01-20: disclosed: Security assessment report prepared by Zellic
  • 2026-05-30: advisory: Initial advisory publication
  • 2026-07-06: other: Advisory updated and published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.