CVE-2026-35381: uutils coreutils Incorrect Provision of Specified Functionality in cut

CVE-2026-35381 · Severity: low · CVSS 3.3 · Published 2026-04-22

The 'cut' utility in the Rust-based uutils coreutils contains a logic error where it fails to filter out certain data records when specific command-line options are used together. This means that automated data processing pipelines relying on this tool to remove malformed or undelimited lines may inadvertently process data that should have been discarded. This could lead to data integrity issues or unexpected behavior in downstream systems that consume the output.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35381 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35381 being exploited in the wild.
How severe is CVE-2026-35381?
Low severity, with a CVSS score of 3.3, published 22 April 2026.
Which products and versions are affected?
uu_cut (crates.io) < 0.7.0, SEMVER:introduced=0,fixed=0.7.0.
Is there a fix for CVE-2026-35381?
Yes. uu_cut (crates.io): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35381 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35381?
Check whether you run uu_cut (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_cut (crates.io): upgrade to 0.7.0 or later
    cargo update -p uu_cut

Technical details

A logic error exists in the 'cut' utility of uutils coreutils (uu_cut) where the combination of -z (null-terminated) and -d '' (empty delimiter) triggers a specialized newline-delimiter code path. This specific path fails to implement the logic for the -s (--only-delimited) flag, which is intended to suppress lines that do not contain the delimiter. As a result, instead of suppressing undelimited records as GNU coreutils does, uutils cut emits the entire record followed by a NUL byte. This is classified as CWE-684 (Incorrect Provision of Specified Functionality). An attacker with local access could potentially exploit this to bypass data filters in automated pipelines. The issue was addressed in version 0.8.0 (and specifically patched in the uu_cut crate in 0.7.0).

Affected products

  • uutils coreutils (uu_cut) < 0.8.0

Identifiers

  • CVE-2026-35381
  • GHSA-pmfc-4wjj-gmhx

Timeline

  • 2026-01: other: Vulnerability identified during Zellic security assessment
  • 2026-03-20: patched: Fix merged into main branch
  • 2026-04-06: other: Release 0.8.0 published
  • 2026-07-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.