Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xp6n-t68q-93dv
Vulnerability ID VCID-xp6n-t68q-93dv
Aliases CVE-2026-35343
GHSA-hj9r-8pfm-rmjj
Summary The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-670 Always-Incorrect Control Flow Implementation
System Score Found at
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-35343
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-35343
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-35343
cvssv3.1_qr LOW https://github.com/advisories/GHSA-hj9r-8pfm-rmjj
cvssv3.1 3.3 https://github.com/uutils/coreutils
generic_textual LOW https://github.com/uutils/coreutils
cvssv3.1 3.3 https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
generic_textual LOW https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
cvssv3.1 3.3 https://github.com/uutils/coreutils/pull/11143
generic_textual LOW https://github.com/uutils/coreutils/pull/11143
ssvc Track https://github.com/uutils/coreutils/pull/11143
cvssv3.1 3.3 https://github.com/uutils/coreutils/releases/tag/0.7.0
generic_textual LOW https://github.com/uutils/coreutils/releases/tag/0.7.0
ssvc Track https://github.com/uutils/coreutils/releases/tag/0.7.0
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2026-35343
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-35343
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35343
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
https://nvd.nist.gov/vuln/detail/CVE-2026-35343
0.7.0 https://github.com/uutils/coreutils/releases/tag/0.7.0
11143 https://github.com/uutils/coreutils/pull/11143
1134876 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134876
GHSA-hj9r-8pfm-rmjj https://github.com/advisories/GHSA-hj9r-8pfm-rmjj
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/pull/11143
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:05:34Z/ Found at https://github.com/uutils/coreutils/pull/11143
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/releases/tag/0.7.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:05:34Z/ Found at https://github.com/uutils/coreutils/releases/tag/0.7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35343
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.03177
EPSS Score 0.00015
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:45:00.719587+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35343.json 38.6.0