{"schema":"threatline.record/2","record":{"id":"CVE-2026-35381","aliases":["GHSA-pmfc-4wjj-gmhx"],"summary":"cut: -s ignored in -z -d '' newline-delimiter mode","details":"`cut` routes `-z -d ''` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on `cut -s` to drop undelimited records process data that should be filtered.\n```\nprintf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00\n```\n\n---\n_Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._","categories":["Libraries & packages"],"product":"uu_cut","vendor":"Uutils","ecosystem":"rust","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pmfc-4wjj-gmhx","source_modified_at":"2026-10-06T18:15:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"rust","name":"uu_cut"},"range":"< 0.8.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-35381","source_modified_at":"2026-04-22T16:53:09.992Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"coreutils","vendor":"Uutils","versions":[{"status":"affected","lessThan":"0.8.0","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pmfc-4wjj-gmhx","source_modified_at":"2026-10-06T18:30:03.603800250Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"crates.io","name":"uu_cut","purl":"pkg:cargo/uu_cut"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.8.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pmfc-4wjj-gmhx","source_modified_at":"2026-10-06T18:15:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"rust","name":"uu_cut"},"version":"0.8.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-35381","source_modified_at":"2026-04-22T16:53:09.992Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"coreutils","ecosystem":null},"version":"0.8.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pmfc-4wjj-gmhx","source_modified_at":"2026-10-06T18:30:03.603800250Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"crates.io","name":"uu_cut","purl":"pkg:cargo/uu_cut"},"version":"0.8.0"}],"cvss":3.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00154,"percentile":0.04157,"score_date":"2026-10-23"},"published_at":"2026-04-22T16:09:22.228Z","modified_at":"2026-10-06T18:30:03.603800250Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-pmfc-4wjj-gmhx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T18:15:54Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-35381","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-04-22T16:53:09.992Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-pmfc-4wjj-gmhx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T18:30:03.603800250Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35381","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/uutils/coreutils/security/advisories/GHSA-pmfc-4wjj-gmhx","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35381","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/uutils/coreutils/pull/11394","tags":["issue-tracking","patch"]},{"url":"https://github.com/uutils/coreutils/commit/483f13e91830c468262aa1e010e753d6ae99c898","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/uutils/coreutils/releases/tag/0.8.0","tags":["vendor-advisory"]},{"url":"https://github.com/advisories/GHSA-pmfc-4wjj-gmhx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-04-22T16:52:48.799157Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T18:30:03.603800250Z","content_hash":"b922acbb78ed809d402c7240adb4b4c6cbfd7ec665d290757f7f62f0cf980bb7"}}