Executive brief
The 'cut' utility in the uutils coreutils package (a Rust-based alternative to standard GNU tools) contains a logic error that prevents it from correctly filtering data. When specific command-line options are used together, the tool fails to suppress lines that do not contain a delimiter, instead outputting the entire record. This can lead to data integrity issues or processing errors in automated scripts and pipelines that rely on the tool to filter out malformed or undelimited data.
Technical details
A logic error exists in the 'cut' utility of uutils coreutils (Rust implementation) due to incorrect routing of specific flag combinations. When the -z (null-terminated) and -d '' (empty delimiter) options are used together, the implementation incorrectly utilizes a specialized newline-delimiter code path that lacks checks for record suppression status. This causes the -s (only-delimited) flag to be ignored, resulting in the utility emitting the entire record plus a NUL byte instead of suppressing undelimited data. This behavior diverges from GNU coreutils and impacts automated data pipelines. The issue is fixed in version 0.8.0.
Affected products
- uutils coreutils (Rust) < 0.8.0
Timeline
- 2026-03-20: patched: Fix merged into main branch via pull request 11394.
- 2026-04-06: advisory: Release 0.8.0 published.
- 2026-04-22: disclosed: Initial GHSA and CVE-2026-35381 published.
- 2026-07-06: other: Advisory GHSA-532v-xp3f-837c withdrawn as a duplicate of GHSA-pmfc-4wjj-gmhx.