Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

coreutils

22 known vulnerabilities (3 high, 13 medium, 6 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
22 · 3 high, 13 medium, 6 low
Weekly downloads
2,724
Dependents
0
Registry
crates.io

Advisories 22

  • uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid

    Affected: from 0.0.18, fixed in 0.10.0.

  • CVE-2026-35380Medium 5.5

    uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing

    Affected: fixed in 0.8.0.

  • uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling

    Affected: fixed in 0.8.0.

  • uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions

    Affected: fixed in 0.8.0.

  • uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode

    Affected: through 0.8.0.

  • CVE-2026-35376Medium 4.5

    uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition

    Affected: through 0.8.0.

  • uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding

    Affected: fixed in 0.8.0.

  • CVE-2026-35374Medium 6.3

    uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition

    Affected: through 0.8.0.

  • CVE-2026-35372Medium 5.0

    uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag

    Affected: fixed in 0.8.0.

  • uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection

    Affected: through 0.8.0.

  • uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions

    Affected: through 0.8.0.

  • CVE-2026-35364Medium 6.3

    uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition

    Affected: through 0.8.0.

  • CVE-2026-35360Medium 6.3

    uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition

    Affected: through 0.8.0.

  • CVE-2026-35359Medium 4.7

    uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap

    Affected: through 0.8.0.

  • CVE-2026-35357Medium 4.7

    uutils coreutils cp Information Disclosure via Permission Handling Race

    Affected: through 0.8.0.

Show all 22 advisoriesShow fewer advisories
  • CVE-2026-35354Medium 4.7

    uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device

    Affected: through 0.8.0.

  • uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition

    Affected: through 0.8.0.

  • CVE-2026-35351Medium 4.2

    uutils coreutils mv Silent Ownership Loss in Cross-Device Operations

    Affected: through 0.8.0.

  • CVE-2026-35350Medium 6.6

    uutils coreutils cp Unexpected Privileged Executable Creation with -p

    Affected: through 0.8.0.

  • CVE-2026-35348Medium 5.5

    uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing

    Affected: through 0.8.0.

  • CVE-2026-35345Medium 5.3

    uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race

    Affected: through 0.8.0.

  • uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression

    Affected: through 0.8.0.