Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/71716?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/71716?format=api", "vulnerability_id": "VCID-an5a-3u2z-bqck", "summary": "A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.", "aliases": [ { "alias": "CVE-2026-35356" }, { "alias": "GHSA-m26v-hjq3-x245" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1087008?format=api", "purl": "pkg:cargo/coreutils@0.7.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:cargo/coreutils@0.7.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/103015?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.7.0-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.7.0-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/103013?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.9.0-3?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.9.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1074841?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.9.0-3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.9.0-3" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1074839?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.0.17-2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1xma-bq3c-u3h9" }, { "vulnerability": "VCID-3npq-hj69-cygg" }, { "vulnerability": "VCID-45py-d4z2-33eh" }, { "vulnerability": "VCID-4asg-vgfk-n7av" }, { "vulnerability": "VCID-7agw-m43h-pkb1" }, { "vulnerability": "VCID-868e-a9h5-vuc7" }, { "vulnerability": "VCID-8wnr-wkj1-n3fw" }, { "vulnerability": "VCID-9wd6-ma2f-dfar" }, { "vulnerability": "VCID-aghn-83cb-rbf2" }, { "vulnerability": "VCID-an5a-3u2z-bqck" }, { "vulnerability": "VCID-cz18-jcfj-ruc9" }, { "vulnerability": "VCID-f86r-a3zm-3bcd" }, { "vulnerability": "VCID-fagp-1t6k-vffu" }, { "vulnerability": "VCID-fmgt-fwj4-wqdu" }, { "vulnerability": "VCID-g5yr-q2gm-tkhk" }, { "vulnerability": "VCID-gtvr-x9jh-w7gk" }, { "vulnerability": "VCID-jfqg-n8g4-y7e3" }, { "vulnerability": "VCID-jkhc-vvqy-uygx" }, { "vulnerability": "VCID-jkma-75vp-xyck" }, { "vulnerability": "VCID-ka1w-rgg3-c3hn" }, { "vulnerability": "VCID-mfjq-bkgq-yycg" }, { "vulnerability": "VCID-q9pt-1vcd-37bg" }, { "vulnerability": "VCID-rkja-wb14-m3hw" }, { "vulnerability": "VCID-rn89-dxgw-bue8" }, { "vulnerability": "VCID-rze6-x7s8-2fb1" }, { "vulnerability": "VCID-s1us-54av-gfhb" }, { "vulnerability": "VCID-szfn-p4u1-k3bp" }, { "vulnerability": "VCID-x173-jyfw-1ued" }, { "vulnerability": "VCID-xp6n-t68q-93dv" }, { "vulnerability": "VCID-xves-5auj-yqdg" }, { "vulnerability": "VCID-yaxf-65d5-7qck" }, { "vulnerability": "VCID-ztuq-wank-67fe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.0.17-2" }, { "url": "http://public2.vulnerablecode.io/api/packages/103011?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.0.17-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1xma-bq3c-u3h9" }, { "vulnerability": "VCID-3npq-hj69-cygg" }, { "vulnerability": "VCID-45py-d4z2-33eh" }, { "vulnerability": "VCID-4asg-vgfk-n7av" }, { "vulnerability": "VCID-7agw-m43h-pkb1" }, { "vulnerability": "VCID-868e-a9h5-vuc7" }, { "vulnerability": "VCID-8wnr-wkj1-n3fw" }, { "vulnerability": "VCID-9wd6-ma2f-dfar" }, { "vulnerability": "VCID-aghn-83cb-rbf2" }, { "vulnerability": "VCID-an5a-3u2z-bqck" }, { "vulnerability": "VCID-cz18-jcfj-ruc9" }, { "vulnerability": "VCID-f86r-a3zm-3bcd" }, { "vulnerability": "VCID-fagp-1t6k-vffu" }, { "vulnerability": "VCID-fmgt-fwj4-wqdu" }, { "vulnerability": "VCID-g5yr-q2gm-tkhk" }, { "vulnerability": "VCID-gtvr-x9jh-w7gk" }, { "vulnerability": "VCID-jfqg-n8g4-y7e3" }, { "vulnerability": "VCID-jkhc-vvqy-uygx" }, { "vulnerability": "VCID-jkma-75vp-xyck" }, { "vulnerability": "VCID-ka1w-rgg3-c3hn" }, { "vulnerability": "VCID-mfjq-bkgq-yycg" }, { "vulnerability": "VCID-q9pt-1vcd-37bg" }, { "vulnerability": "VCID-rkja-wb14-m3hw" }, { "vulnerability": "VCID-rn89-dxgw-bue8" }, { "vulnerability": "VCID-rze6-x7s8-2fb1" }, { "vulnerability": "VCID-s1us-54av-gfhb" }, { "vulnerability": "VCID-szfn-p4u1-k3bp" }, { "vulnerability": "VCID-x173-jyfw-1ued" }, { "vulnerability": "VCID-xp6n-t68q-93dv" }, { "vulnerability": "VCID-xves-5auj-yqdg" }, { "vulnerability": "VCID-yaxf-65d5-7qck" }, { "vulnerability": "VCID-ztuq-wank-67fe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.0.17-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/103012?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.0.30-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1xma-bq3c-u3h9" }, { "vulnerability": "VCID-3npq-hj69-cygg" }, { "vulnerability": "VCID-45py-d4z2-33eh" }, { "vulnerability": "VCID-4asg-vgfk-n7av" }, { "vulnerability": "VCID-7agw-m43h-pkb1" }, { "vulnerability": "VCID-868e-a9h5-vuc7" }, { "vulnerability": "VCID-8wnr-wkj1-n3fw" }, { "vulnerability": "VCID-9wd6-ma2f-dfar" }, { "vulnerability": "VCID-aghn-83cb-rbf2" }, { "vulnerability": "VCID-an5a-3u2z-bqck" }, { "vulnerability": "VCID-cz18-jcfj-ruc9" }, { "vulnerability": "VCID-f86r-a3zm-3bcd" }, { "vulnerability": "VCID-fagp-1t6k-vffu" }, { "vulnerability": "VCID-fmgt-fwj4-wqdu" }, { "vulnerability": "VCID-g5yr-q2gm-tkhk" }, { "vulnerability": "VCID-gtvr-x9jh-w7gk" }, { "vulnerability": "VCID-jfqg-n8g4-y7e3" }, { "vulnerability": "VCID-jkhc-vvqy-uygx" }, { "vulnerability": "VCID-jkma-75vp-xyck" }, { "vulnerability": "VCID-ka1w-rgg3-c3hn" }, { "vulnerability": "VCID-mfjq-bkgq-yycg" }, { "vulnerability": "VCID-q9pt-1vcd-37bg" }, { "vulnerability": "VCID-rkja-wb14-m3hw" }, { "vulnerability": "VCID-rn89-dxgw-bue8" }, { "vulnerability": "VCID-rze6-x7s8-2fb1" }, { "vulnerability": "VCID-s1us-54av-gfhb" }, { "vulnerability": "VCID-szfn-p4u1-k3bp" }, { "vulnerability": "VCID-x173-jyfw-1ued" }, { "vulnerability": "VCID-xp6n-t68q-93dv" }, { "vulnerability": "VCID-xves-5auj-yqdg" }, { "vulnerability": "VCID-yaxf-65d5-7qck" }, { "vulnerability": "VCID-ztuq-wank-67fe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.0.30-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1074840?format=api", "purl": "pkg:deb/debian/rust-coreutils@0.0.30-2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1xma-bq3c-u3h9" }, { "vulnerability": "VCID-3npq-hj69-cygg" }, { "vulnerability": "VCID-45py-d4z2-33eh" }, { "vulnerability": "VCID-4asg-vgfk-n7av" }, { "vulnerability": "VCID-7agw-m43h-pkb1" }, { "vulnerability": "VCID-868e-a9h5-vuc7" }, { "vulnerability": "VCID-8wnr-wkj1-n3fw" }, { "vulnerability": "VCID-9wd6-ma2f-dfar" }, { "vulnerability": "VCID-aghn-83cb-rbf2" }, { "vulnerability": "VCID-an5a-3u2z-bqck" }, { "vulnerability": "VCID-cz18-jcfj-ruc9" }, { "vulnerability": "VCID-f86r-a3zm-3bcd" }, { "vulnerability": "VCID-fagp-1t6k-vffu" }, { "vulnerability": "VCID-fmgt-fwj4-wqdu" }, { "vulnerability": "VCID-g5yr-q2gm-tkhk" }, { "vulnerability": "VCID-gtvr-x9jh-w7gk" }, { "vulnerability": "VCID-jfqg-n8g4-y7e3" }, { "vulnerability": "VCID-jkhc-vvqy-uygx" }, { "vulnerability": "VCID-jkma-75vp-xyck" }, { "vulnerability": "VCID-ka1w-rgg3-c3hn" }, { "vulnerability": "VCID-mfjq-bkgq-yycg" }, { "vulnerability": "VCID-q9pt-1vcd-37bg" }, { "vulnerability": "VCID-rkja-wb14-m3hw" }, { "vulnerability": "VCID-rn89-dxgw-bue8" }, { "vulnerability": "VCID-rze6-x7s8-2fb1" }, { "vulnerability": "VCID-s1us-54av-gfhb" }, { "vulnerability": "VCID-szfn-p4u1-k3bp" }, { "vulnerability": "VCID-x173-jyfw-1ued" }, { "vulnerability": "VCID-xp6n-t68q-93dv" }, { "vulnerability": "VCID-xves-5auj-yqdg" }, { "vulnerability": "VCID-yaxf-65d5-7qck" }, { "vulnerability": "VCID-ztuq-wank-67fe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/rust-coreutils@0.0.30-2" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35356", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00014", "scoring_system": "epss", "scoring_elements": "0.02781", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00014", "scoring_system": "epss", "scoring_elements": "0.02773", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35356" }, { "reference_url": "https://github.com/uutils/coreutils", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/uutils/coreutils" }, { "reference_url": "https://github.com/uutils/coreutils/commit/0c41299975f3c1e21cf5ca968d42cad55ceb42a1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/uutils/coreutils/commit/0c41299975f3c1e21cf5ca968d42cad55ceb42a1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35356", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35356" }, { "reference_url": "https://github.com/uutils/coreutils/releases/tag/0.7.0", "reference_id": "0.7.0", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T17:59:48Z/" } ], "url": "https://github.com/uutils/coreutils/releases/tag/0.7.0" }, { "reference_url": "https://github.com/uutils/coreutils/pull/10140", "reference_id": "10140", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T17:59:48Z/" } ], "url": "https://github.com/uutils/coreutils/pull/10140" }, { "reference_url": "https://github.com/advisories/GHSA-m26v-hjq3-x245", "reference_id": "GHSA-m26v-hjq3-x245", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-m26v-hjq3-x245" } ], "weaknesses": [ { "cwe_id": 367, "name": "Time-of-check Time-of-use (TOCTOU) Race Condition", "description": "The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-an5a-3u2z-bqck" }