CVE-2026-35343

LOW EPSS 3.3%
Published Apr 22, 20262mo ago · Modified Jun 17, 20261w ago
3.3 CVSS 3.1
Low
Find Similar
Published Apr 22, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

CVSS Details

Base Score
3.3
Exploitability
1.8
Impact
1.4
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
3.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-670

Affected Products 1

VendorProductVersionRange
uutilscoreutils* <0.7.0

References 2

  • github.com https://github.com/uutils/coreutils/pull/11143
    Issue TrackingPatch
  • github.com https://github.com/uutils/coreutils/releases/tag/0.7.0
    Release Notes

Remediation

  • github.com https://github.com/uutils/coreutils/pull/11143
    Issue TrackingPatch