# coreutils (crates.io) vulnerabilities 22 known vulnerabilities (3 high, 13 medium, 6 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 2,724 - Dependents: 0 - Registry: https://crates.io/crates/coreutils ## Advisories (22) ### [CVE-2026-93658](https://cve.now/CVE-2026-93658): uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid - Severity: High 7.3 - Published: Sep 18, 2026 - Affected: from 0.0.18, fixed in 0.10.0. ### [CVE-2026-35380](https://cve.now/CVE-2026-35380): uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing - Severity: Medium 5.5 - Published: Apr 22, 2026 - Affected: fixed in 0.8.0. ### [CVE-2026-35379](https://cve.now/CVE-2026-35379): uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: fixed in 0.8.0. ### [CVE-2026-35378](https://cve.now/CVE-2026-35378): uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: fixed in 0.8.0. ### [CVE-2026-35377](https://cve.now/CVE-2026-35377): uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35376](https://cve.now/CVE-2026-35376): uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition - Severity: Medium 4.5 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35375](https://cve.now/CVE-2026-35375): uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: fixed in 0.8.0. ### [CVE-2026-35374](https://cve.now/CVE-2026-35374): uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition - Severity: Medium 6.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35372](https://cve.now/CVE-2026-35372): uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag - Severity: Medium 5.0 - Published: Apr 22, 2026 - Affected: fixed in 0.8.0. ### [CVE-2026-35368](https://cve.now/CVE-2026-35368): uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection - Severity: High 7.2 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35367](https://cve.now/CVE-2026-35367): uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35364](https://cve.now/CVE-2026-35364): uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition - Severity: Medium 6.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35360](https://cve.now/CVE-2026-35360): uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition - Severity: Medium 6.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35359](https://cve.now/CVE-2026-35359): uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap - Severity: Medium 4.7 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35357](https://cve.now/CVE-2026-35357): uutils coreutils cp Information Disclosure via Permission Handling Race - Severity: Medium 4.7 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35354](https://cve.now/CVE-2026-35354): uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device - Severity: Medium 4.7 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35352](https://cve.now/CVE-2026-35352): uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition - Severity: High 7.0 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35351](https://cve.now/CVE-2026-35351): uutils coreutils mv Silent Ownership Loss in Cross-Device Operations - Severity: Medium 4.2 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35350](https://cve.now/CVE-2026-35350): uutils coreutils cp Unexpected Privileged Executable Creation with -p - Severity: Medium 6.6 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35348](https://cve.now/CVE-2026-35348): uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing - Severity: Medium 5.5 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35345](https://cve.now/CVE-2026-35345): uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race - Severity: Medium 5.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. ### [CVE-2026-35344](https://cve.now/CVE-2026-35344): uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression - Severity: Low 3.3 - Published: Apr 22, 2026 - Affected: through 0.8.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/coreutils Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.