CVE-2026-35371: uutils coreutils UI misrepresentation in id utility

CVE-2026-35371 · Severity: low · CVSS 3.3 · Published 2026-04-22

The 'id' utility in uutils coreutils, a Rust-based implementation of standard system tools, contains a bug that displays incorrect user information. When a user's effective identity differs from their real identity, the tool may show the wrong username in its output. This can mislead system administrators or automated scripts into making incorrect security decisions regarding file permissions and access controls.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35371 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35371 being exploited in the wild.
How severe is CVE-2026-35371?
Low severity, with a CVSS score of 3.3, published 22 April 2026.
Which products and versions are affected?
uu_id (crates.io) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-35371?
Yes. uu_id (crates.io): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35371 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35371?
Check whether you run uu_id (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_id (crates.io): upgrade to 0.6.0 or later
    cargo update -p uu_id

Technical details

A logic error exists in the 'id' utility of uutils coreutils (specifically the uu_id crate) where the implementation incorrectly uses the effective Group ID (GID) instead of the effective User ID (UID) when performing a name lookup for the effective user. This occurs specifically in the 'pretty print' output mode when the real UID and effective UID differ. An attacker with local access cannot directly escalate privileges through this bug, but the resulting UI misrepresentation (CWE-451) can cause diagnostic tools or scripts to misidentify the active user context. The issue was identified in audited commit 3a07ffc5 and is fixed in version 0.6.0.

Affected products

  • uutils coreutils (uu_id) < 0.6.0

Identifiers

  • CVE-2026-35371
  • GHSA-xv5w-cw7x-72gj

Timeline

  • 2026-01-03: disclosed: Issue reported on GitHub
  • 2026-05-30: advisory: GitHub Advisory published
  • 2026-05-30: patched: Version 0.6.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.