Executive brief
The 'cut' utility in the Rust-based uutils coreutils contains a logic error where it fails to filter out certain data records when specific command-line options are used together. This means that automated data processing pipelines relying on this tool to remove malformed or undelimited lines may inadvertently process data that should have been discarded. This could lead to data integrity issues or unexpected behavior in downstream systems that consume the output.
Technical details
A logic error exists in the 'cut' utility of uutils coreutils (uu_cut) where the combination of -z (null-terminated) and -d '' (empty delimiter) triggers a specialized newline-delimiter code path. This specific path fails to implement the logic for the -s (--only-delimited) flag, which is intended to suppress lines that do not contain the delimiter. As a result, instead of suppressing undelimited records as GNU coreutils does, uutils cut emits the entire record followed by a NUL byte. This is classified as CWE-684 (Incorrect Provision of Specified Functionality). An attacker with local access could potentially exploit this to bypass data filters in automated pipelines. The issue was addressed in version 0.8.0 (and specifically patched in the uu_cut crate in 0.7.0).
Affected products
- uutils coreutils (uu_cut) < 0.8.0
Timeline
- 2026-01: other: Vulnerability identified during Zellic security assessment
- 2026-03-20: patched: Fix merged into main branch
- 2026-04-06: other: Release 0.8.0 published
- 2026-07-06: advisory: GitHub Advisory published
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-pmfc-4wjj-gmhx
- https://github.com/uutils/coreutils/pull/11394
- https://github.com/uutils/coreutils/commit/483f13e91830c468262aa1e010e753d6ae99c898
- https://github.com/uutils/coreutils/releases/tag/0.8.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-pmfc-4wjj-gmhx