EUVD-2026-24973
GHSA-hj9r-8pfm-rmjj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
AnalysisAI
The cut utility in uutils coreutils fails to suppress non-delimited lines when the -s (only-delimited) option is used with a newline character as the delimiter, causing unfiltered data to be passed to downstream processes. Affected versions prior to 0.8.0 exhibit this logic error, which has low real-world impact due to local-only attack vector and partial technical scope, though it violates strict data filtering contracts that scripts may depend upon.
Technical ContextAI
The cut utility processes text input and extracts or removes specific fields based on delimiter and column specifications. The -s flag (only-delimited) instructs cut to suppress lines that do not contain the specified delimiter character. In uutils coreutils, the cut_fields_newline_char_delim function processes input when a newline is the chosen delimiter but fails to check the only_delimited flag before printing lines. This is a logic control-flow error (CWE-670: Improper Check or Handling of Exceptional Conditions) where a conditional check is omitted entirely in one code path. The newline delimiter case appears to have been implemented separately and the filtering logic was not propagated to this path, resulting in incorrect behavior diverging from GNU coreutils standard cut.
RemediationAI
Upgrade uutils coreutils to version 0.8.0 or later, which includes the patch committed in pull request #11143. For users unable to patch immediately, configure input validation upstream of the cut command to reject non-delimited records before they reach cut, or use GNU coreutils as a drop-in replacement if uutils coreutils is optional in your toolchain. Note that this workaround adds latency and shifts validation logic but does not affect the availability of cut itself. Verify the upgrade by testing cut with the -s flag and newline delimiter against a mixed input file containing both delimited and non-delimited lines; patched versions should suppress non-delimited output.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today