CVE-2026-35366: uutils coreutils printenv inspection evasion via invalid UTF-8 sequences

CVE-2026-35366 · Severity: medium · CVSS 4.4 · Published 2026-04-22

The printenv utility in uutils coreutils, a Rust-based implementation of standard system tools, fails to display environment variables that contain invalid UTF-8 characters. This allows a local attacker to hide malicious environment settings, such as those used to hijack software libraries (LD_PRELOAD), from administrators and security auditing tools. While the system remains functional, security monitoring may fail to detect unauthorized changes to the environment.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35366 being exploited in the wild.
How severe is CVE-2026-35366?
Medium severity, with a CVSS score of 4.4, published 22 April 2026.
Which products and versions are affected?
uu_printenv (crates.io) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-35366?
Yes. uu_printenv (crates.io): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35366 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35366?
Check whether you run uu_printenv (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_printenv (crates.io): upgrade to 0.6.0 or later
    cargo update -p uu_printenv

Technical details

The printenv utility in uutils coreutils (uu_printenv) incorrectly uses Rust's env::var() and env::vars() functions, which silently skip environment variables that are not valid UTF-8. According to POSIX standards, environment variables can contain arbitrary byte sequences. An attacker with local access can craft environment variables (e.g., LD_PRELOAD) containing invalid UTF-8 bytes to ensure they are hidden from administrators or automated security scanners using printenv. This issue was resolved in version 0.6.0 by switching to the _os() variants of the environment functions to handle raw byte sequences.

Affected products

  • uutils coreutils (uu_printenv) < 0.6.0

Identifiers

  • CVE-2026-35366
  • GHSA-p7h3-7q52-72w8

Timeline

  • 2025-12-18: disclosed: Issue reported to uutils coreutils maintainers
  • 2025-12-22: patched: Fix merged into main branch
  • 2026-05-30: advisory: Initial advisory published by maintainers
  • 2026-07-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.