Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.5, published 22 April 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-01-09: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

uutils coreutils incorrect exit code in chown and chgrp

Severity: medium · CVSS 5.5 · Published 2026-04-22

A flaw in the Rust-based uutils coreutils implementation of the chown and chgrp commands causes them to report success even if some file ownership changes failed. When processing directories recursively, the tools only check the result of the very last file processed; if that file succeeds, the command returns a success code regardless of earlier failures. This can lead to security misconfigurations where administrative scripts incorrectly assume that sensitive files have had their ownership or group permissions properly updated.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.5, published 22 April 2026.
Which products and versions are affected?: uutils coreutils < 0.6.0.
Is there a fix for This vulnerability?: A patch was published on 2026-01-09: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ChownExecutor component of uutils coreutils (the Rust implementation of GNU coreutils) affecting the chown and chgrp utilities. During recursive operations, the final exit code is determined solely by the result of the last file processed in the directory tree. If earlier files fail to update due to permission errors but the final file succeeds, the utility returns an exit code of 0. This 'Incorrect Check of Function Return Value' (CWE-253) allows local users or automated scripts to be misled about the integrity of ownership changes. The issue is fixed in version 0.6.0 by ensuring the exit code reflects any encountered errors during the traversal.

Affected products

uutils coreutils < 0.6.0

Timeline

2026-01-09: patched: Fix merged into main branch
2026-02-02: advisory: Version 0.6.0 released
2026-04-22: disclosed: Initial GHSA and CVE publication
2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-2x2h-fw32-rq7v

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.