Executive brief
The 'cut' utility in the Rust-based uutils coreutils package contains a logic error when processing files using a newline character as a delimiter. When the 'only-delimited' (-s) flag is used, the tool fails to suppress lines that do not contain the delimiter as it should. This can cause automated scripts or data pipelines to receive unexpected or malformed data, potentially leading to downstream processing errors or incorrect reporting.
Technical details
A logic error exists in the `cut_fields_newline_char_delim` function of the uutils coreutils 'cut' utility. The implementation fails to verify the `only_delimited` flag when a newline character is explicitly set as the delimiter. Consequently, lines that do not contain the specified delimiter are printed instead of being suppressed. An attacker with local access could potentially leverage this to bypass strict output filters in scripts that rely on 'cut' for data sanitization or formatting. The issue is addressed in version 0.7.0 by adding the missing flag check and optimizing the control flow.
Affected products
- uutils coreutils (Rust) < 0.7.0
Timeline
- 2026-02-27: other: Pull request submitted to fix the logic error
- 2026-03-08: patched: Fixed in version 0.7.0 release
- 2026-04-22: disclosed: Initial advisory publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-wv33-5pxh-r7j7