# CVE-2026-35371: uutils coreutils UI misrepresentation in id utility

Source: https://junglewise.ai/threats/cve-2026-35371-uutils-coreutils-ui-misrepresentation-in-id-utility  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-35371 · Severity: low · CVSS 3.3 · Published 2026-04-22

The 'id' utility in uutils coreutils, a Rust-based implementation of standard system tools, contains a bug that displays incorrect user information. When a user's effective identity differs from their real identity, the tool may show the wrong username in its output. This can mislead system administrators or automated scripts into making incorrect security decisions regarding file permissions and access controls.

Technologies: [Uutils Coreutils](https://junglewise.ai/threats/technologies/uutils-coreutils). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Uutils](https://junglewise.ai/threats/vendors/uutils).

## Quick answers

**Is CVE-2026-35371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35371 being exploited in the wild.

**How severe is CVE-2026-35371?** Low severity, with a CVSS score of 3.3, published 22 April 2026.

**Which products and versions are affected?** uu_id (crates.io) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.

**Is there a fix for CVE-2026-35371?** Yes. uu_id (crates.io): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35371 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-35371?** Check whether you run uu_id (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- uu_id (crates.io): upgrade to 0.6.0 or later

  ```sh
  cargo update -p uu_id
  ```


## Technical details

A logic error exists in the 'id' utility of uutils coreutils (specifically the uu_id crate) where the implementation incorrectly uses the effective Group ID (GID) instead of the effective User ID (UID) when performing a name lookup for the effective user. This occurs specifically in the 'pretty print' output mode when the real UID and effective UID differ. An attacker with local access cannot directly escalate privileges through this bug, but the resulting UI misrepresentation (CWE-451) can cause diagnostic tools or scripts to misidentify the active user context. The issue was identified in audited commit 3a07ffc5 and is fixed in version 0.6.0.

## Affected products

- uutils coreutils (uu_id) < 0.6.0

## Identifiers

- CVE-2026-35371
- GHSA-xv5w-cw7x-72gj

## Timeline

- 2026-01-03: disclosed: Issue reported on GitHub
- 2026-05-30: advisory: GitHub Advisory published
- 2026-05-30: patched: Version 0.6.0 released

## References

- [https://github.com/uutils/coreutils/security/advisories/GHSA-xv5w-cw7x-72gj](https://github.com/uutils/coreutils/security/advisories/GHSA-xv5w-cw7x-72gj)
- [https://github.com/uutils/coreutils/issues/10006](https://github.com/uutils/coreutils/issues/10006)
- [https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-xv5w-cw7x-72gj](https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-xv5w-cw7x-72gj)

## Related threats

- [uutils coreutils Incorrect Provision of Specified Functionality in cut](https://junglewise.ai/threats/cve-2026-35381-uutils-coreutils-incorrect-provision-of-specified-functionality)
- [uutils coreutils has an Improper Input Validation Issue in its cut Utility](https://junglewise.ai/threats/cve-2026-35380-uutils-coreutils-has-an-improper-input-validation-issue-in-its)
- [A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes.](https://junglewise.ai/threats/cve-2026-35379-uutils-coreutils-has-an-incorrect-provision-of-specified)
- [uutils coreutils has an Incorrect Short Circuit Evaluation Issue](https://junglewise.ai/threats/cve-2026-35378-uutils-coreutils-has-an-incorrect-short-circuit-evaluation-issue)
- [uutils coreutils has an Improper Input Validation Issue in its env Utility](https://junglewise.ai/threats/cve-2026-35377-uutils-coreutils-has-an-improper-input-validation-issue-in-its)