uu_cut

Version	Released
`0.11.0` minor	Sep 01, 2026
`0.10.0` minor	Aug 05, 2026
`0.9.0` unknown	May 30, 2026
`0.8.0` unknown	Apr 06, 2026
`0.7.0` unknown	Mar 09, 2026
`0.6.0` unknown 2 CVEs	Feb 03, 2026
`0.5.0` unknown 2 CVEs	Dec 14, 2025
`0.4.0` unknown 2 CVEs	Nov 10, 2025
`0.3.0` unknown 2 CVEs	Oct 25, 2025
`0.2.2` unknown 2 CVEs	Sep 09, 2025
`0.2.0` unknown yanked 2 CVEs	Sep 06, 2025
`0.1.0` unknown 2 CVEs	May 25, 2025
`0.0.30` unknown 2 CVEs	Mar 08, 2025
`0.0.29` unknown 2 CVEs	Jan 18, 2025
`0.0.28` unknown 2 CVEs	Nov 17, 2024
`0.0.27` unknown 2 CVEs	Jun 22, 2024
`0.0.26` unknown 2 CVEs	Apr 26, 2024
`0.0.25` unknown 2 CVEs	Mar 23, 2024
`0.0.24` unknown 2 CVEs	Jan 24, 2024
`0.0.23` unknown 2 CVEs	Nov 14, 2023
`0.0.22` unknown 2 CVEs	Oct 15, 2023
`0.0.21` unknown 2 CVEs	Sep 04, 2023
`0.0.20` unknown 2 CVEs	Jul 14, 2023
`0.0.19` unknown 2 CVEs	Jun 04, 2023
`0.0.18` unknown 2 CVEs	Apr 02, 2023
`0.0.17` unknown 2 CVEs	Jan 21, 2023
`0.0.16` unknown 2 CVEs	Oct 12, 2022
`0.0.15` unknown 2 CVEs	Aug 20, 2022
`0.0.14` unknown 2 CVEs	May 22, 2022
`0.0.13` unknown 2 CVEs	Apr 02, 2022
`0.0.12` unknown 2 CVEs	Jan 19, 2022
`0.0.9` unknown 2 CVEs	Jan 16, 2022
`0.0.8` unknown 2 CVEs	Oct 23, 2021
`0.0.7` unknown 2 CVEs	Jul 11, 2021
`0.0.6` unknown 2 CVEs	Apr 03, 2021
`0.0.5` unknown 2 CVEs	Apr 03, 2021
`0.0.4` unknown 2 CVEs	Mar 07, 2021
`0.0.3` unknown 2 CVEs	Feb 02, 2021
`0.0.2` unknown 2 CVEs	Jan 10, 2021
`0.0.1` unknown 2 CVEs	May 31, 2020

0.11.0 minor

Sep 01, 2026

0.10.0 minor

Aug 05, 2026

0.9.0 unknown

May 30, 2026

0.8.0 unknown

Apr 06, 2026

0.7.0 unknown

Mar 09, 2026

0.6.0 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Feb 03, 2026

0.5.0 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Dec 14, 2025

0.4.0 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 10, 2025

0.3.0 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 25, 2025

0.2.2 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 09, 2025

0.2.0 unknown yanked

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 06, 2025

0.1.0 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 25, 2025

0.0.30 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 08, 2025

0.0.29 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 18, 2025

0.0.28 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 17, 2024

0.0.27 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 22, 2024

0.0.26 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 26, 2024

0.0.25 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 23, 2024

0.0.24 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 24, 2024

0.0.23 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 14, 2023

0.0.22 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 15, 2023

0.0.21 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 04, 2023

0.0.20 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 14, 2023

0.0.19 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 04, 2023

0.0.18 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2023

0.0.17 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 21, 2023

0.0.16 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 12, 2022

0.0.15 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Aug 20, 2022

0.0.14 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 22, 2022

0.0.13 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2022

0.0.12 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 19, 2022

0.0.9 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 16, 2022

0.0.8 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 23, 2021

0.0.7 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 11, 2021

0.0.6 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.5 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.4 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 07, 2021

0.0.3 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Feb 02, 2021

0.0.2 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 10, 2021

0.0.1 unknown

2 CVEs

CVE-2026-35381 GHSA-pmfc-4wjj-gmhx Jul 06, 2026

cut: -s ignored in -z -d '' newline-delimiter mode

3.3 / 10

Low

Local Low Low None Unchanged None Low None

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-35343 GHSA-wv33-5pxh-r7j7 Jul 06, 2026

cut: -s (only-delimited) ignored when delimiter is a newline

3.3 / 10

Low

Local Low Low None Unchanged None Low None

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.7.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 31, 2020

Activity

Reach

Details