Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rn89-dxgw-bue8
Vulnerability ID VCID-rn89-dxgw-bue8
Aliases CVE-2026-35380
GHSA-m2pg-c7m6-77pj
Summary A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-35380
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-35380
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-35380
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-m2pg-c7m6-77pj
cvssv3.1 5.5 https://github.com/uutils/coreutils
generic_textual MODERATE https://github.com/uutils/coreutils
cvssv3.1 5.5 https://github.com/uutils/coreutils/commit/593f5b191e8b9c87e4292955999c2d0b5cbcce69
generic_textual MODERATE https://github.com/uutils/coreutils/commit/593f5b191e8b9c87e4292955999c2d0b5cbcce69
cvssv3.1 5.5 https://github.com/uutils/coreutils/pull/11399
generic_textual MODERATE https://github.com/uutils/coreutils/pull/11399
ssvc Track https://github.com/uutils/coreutils/pull/11399
cvssv3.1 5.5 https://github.com/uutils/coreutils/releases/tag/0.8.0
generic_textual MODERATE https://github.com/uutils/coreutils/releases/tag/0.8.0
ssvc Track https://github.com/uutils/coreutils/releases/tag/0.8.0
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2026-35380
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-35380
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35380
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/commit/593f5b191e8b9c87e4292955999c2d0b5cbcce69
https://nvd.nist.gov/vuln/detail/CVE-2026-35380
0.8.0 https://github.com/uutils/coreutils/releases/tag/0.8.0
1134876 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134876
11399 https://github.com/uutils/coreutils/pull/11399
GHSA-m2pg-c7m6-77pj https://github.com/advisories/GHSA-m2pg-c7m6-77pj
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/uutils/coreutils
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/uutils/coreutils/commit/593f5b191e8b9c87e4292955999c2d0b5cbcce69
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/uutils/coreutils/pull/11399
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T16:53:51Z/ Found at https://github.com/uutils/coreutils/pull/11399
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/uutils/coreutils/releases/tag/0.8.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T16:53:51Z/ Found at https://github.com/uutils/coreutils/releases/tag/0.8.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35380
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06463
EPSS Score 0.00022
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:58.597283+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35380.json 38.6.0