uu_ln

Version	Released
`0.11.0` minor	Sep 01, 2026
`0.10.0` minor	Aug 05, 2026
`0.9.0` unknown	May 30, 2026
`0.8.0` unknown	Apr 06, 2026
`0.7.0` unknown	Mar 09, 2026
`0.6.0` unknown	Feb 03, 2026
`0.5.0` unknown 1 CVE	Dec 14, 2025
`0.4.0` unknown 1 CVE	Nov 10, 2025
`0.3.0` unknown 1 CVE	Oct 25, 2025
`0.2.2` unknown 1 CVE	Sep 09, 2025
`0.2.0` unknown yanked 1 CVE	Sep 06, 2025
`0.1.0` unknown 1 CVE	May 25, 2025
`0.0.30` unknown 1 CVE	Mar 08, 2025
`0.0.29` unknown 1 CVE	Jan 18, 2025
`0.0.28` unknown 1 CVE	Nov 17, 2024
`0.0.27` unknown 1 CVE	Jun 22, 2024
`0.0.26` unknown 1 CVE	Apr 26, 2024
`0.0.25` unknown 1 CVE	Mar 23, 2024
`0.0.24` unknown 1 CVE	Jan 24, 2024
`0.0.23` unknown 1 CVE	Nov 14, 2023
`0.0.22` unknown 1 CVE	Oct 15, 2023
`0.0.21` unknown 1 CVE	Sep 04, 2023
`0.0.20` unknown 1 CVE	Jul 14, 2023
`0.0.19` unknown 1 CVE	Jun 04, 2023
`0.0.18` unknown 1 CVE	Apr 02, 2023
`0.0.17` unknown 1 CVE	Jan 21, 2023
`0.0.16` unknown 1 CVE	Oct 12, 2022
`0.0.15` unknown 1 CVE	Aug 20, 2022
`0.0.14` unknown 1 CVE	May 22, 2022
`0.0.13` unknown 1 CVE	Apr 02, 2022
`0.0.12` unknown 1 CVE	Jan 19, 2022
`0.0.9` unknown 1 CVE	Jan 16, 2022
`0.0.8` unknown 1 CVE	Oct 23, 2021
`0.0.7` unknown 1 CVE	Jul 11, 2021
`0.0.6` unknown 1 CVE	Apr 03, 2021
`0.0.5` unknown 1 CVE	Apr 03, 2021
`0.0.4` unknown 1 CVE	Mar 07, 2021
`0.0.3` unknown 1 CVE	Feb 02, 2021
`0.0.2` unknown 1 CVE	Jan 10, 2021
`0.0.1` unknown 1 CVE	May 31, 2020

0.11.0 minor

Sep 01, 2026

0.10.0 minor

Aug 05, 2026

0.9.0 unknown

May 30, 2026

0.8.0 unknown

Apr 06, 2026

0.7.0 unknown

Mar 09, 2026

0.6.0 unknown

Feb 03, 2026

0.5.0 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Dec 14, 2025

0.4.0 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 10, 2025

0.3.0 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 25, 2025

0.2.2 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 09, 2025

0.2.0 unknown yanked

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 06, 2025

0.1.0 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 25, 2025

0.0.30 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 08, 2025

0.0.29 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 18, 2025

0.0.28 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 17, 2024

0.0.27 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 22, 2024

0.0.26 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 26, 2024

0.0.25 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 23, 2024

0.0.24 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 24, 2024

0.0.23 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 14, 2023

0.0.22 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 15, 2023

0.0.21 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 04, 2023

0.0.20 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 14, 2023

0.0.19 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 04, 2023

0.0.18 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2023

0.0.17 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 21, 2023

0.0.16 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 12, 2022

0.0.15 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Aug 20, 2022

0.0.14 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 22, 2022

0.0.13 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2022

0.0.12 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 19, 2022

0.0.9 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 16, 2022

0.0.8 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 23, 2021

0.0.7 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 11, 2021

0.0.6 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.5 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.4 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 07, 2021

0.0.3 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Feb 02, 2021

0.0.2 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 10, 2021

0.0.1 unknown

1 CVE

CVE-2026-35373 GHSA-jcjr-rh8q-7xqf Jul 06, 2026

ln: rejects non-UTF-8 source filenames in target-directory mode

3.3 / 10

Low

Local Low Low None Unchanged None None Low

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 31, 2020

Activity

Reach

Details