uu_mkfifo

Version	Released
`0.11.0` minor	Sep 01, 2026
`0.10.0` minor	Aug 05, 2026
`0.9.0` unknown	May 30, 2026
`0.8.0` unknown	Apr 06, 2026
`0.7.0` unknown	Mar 09, 2026
`0.6.0` unknown	Feb 03, 2026
`0.5.0` unknown 1 CVE	Dec 14, 2025
`0.4.0` unknown 1 CVE	Nov 10, 2025
`0.3.0` unknown 1 CVE	Oct 25, 2025
`0.2.2` unknown 1 CVE	Sep 09, 2025
`0.2.0` unknown yanked 1 CVE	Sep 06, 2025
`0.1.0` unknown 1 CVE	May 25, 2025
`0.0.30` unknown 1 CVE	Mar 08, 2025
`0.0.29` unknown 1 CVE	Jan 18, 2025
`0.0.28` unknown 1 CVE	Nov 17, 2024
`0.0.27` unknown 1 CVE	Jun 22, 2024
`0.0.26` unknown 1 CVE	Apr 26, 2024
`0.0.25` unknown 1 CVE	Mar 23, 2024
`0.0.24` unknown 1 CVE	Jan 24, 2024
`0.0.23` unknown 1 CVE	Nov 14, 2023
`0.0.22` unknown 1 CVE	Oct 15, 2023
`0.0.21` unknown 1 CVE	Sep 04, 2023
`0.0.20` unknown 1 CVE	Jul 14, 2023
`0.0.19` unknown 1 CVE	Jun 04, 2023
`0.0.18` unknown 1 CVE	Apr 02, 2023
`0.0.17` unknown 1 CVE	Jan 21, 2023
`0.0.16` unknown 1 CVE	Oct 12, 2022
`0.0.15` unknown 1 CVE	Aug 20, 2022
`0.0.14` unknown 1 CVE	May 22, 2022
`0.0.13` unknown 1 CVE	Apr 02, 2022
`0.0.12` unknown 1 CVE	Jan 19, 2022
`0.0.9` unknown 1 CVE	Jan 16, 2022
`0.0.8` unknown 1 CVE	Oct 23, 2021
`0.0.7` unknown 1 CVE	Jul 11, 2021
`0.0.6` unknown 1 CVE	Apr 03, 2021
`0.0.5` unknown 1 CVE	Apr 03, 2021
`0.0.4` unknown 1 CVE	Mar 07, 2021
`0.0.3` unknown 1 CVE	Feb 02, 2021
`0.0.2` unknown 1 CVE	Jan 10, 2021
`0.0.1` unknown 1 CVE	May 31, 2020

0.11.0 minor

Sep 01, 2026

0.10.0 minor

Aug 05, 2026

0.9.0 unknown

May 30, 2026

0.8.0 unknown

Apr 06, 2026

0.7.0 unknown

Mar 09, 2026

0.6.0 unknown

Feb 03, 2026

0.5.0 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Dec 14, 2025

0.4.0 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 10, 2025

0.3.0 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 25, 2025

0.2.2 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 09, 2025

0.2.0 unknown yanked

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 06, 2025

0.1.0 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 25, 2025

0.0.30 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 08, 2025

0.0.29 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 18, 2025

0.0.28 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 17, 2024

0.0.27 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 22, 2024

0.0.26 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 26, 2024

0.0.25 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 23, 2024

0.0.24 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 24, 2024

0.0.23 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 14, 2023

0.0.22 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 15, 2023

0.0.21 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 04, 2023

0.0.20 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 14, 2023

0.0.19 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 04, 2023

0.0.18 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2023

0.0.17 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 21, 2023

0.0.16 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 12, 2022

0.0.15 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Aug 20, 2022

0.0.14 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 22, 2022

0.0.13 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2022

0.0.12 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 19, 2022

0.0.9 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 16, 2022

0.0.8 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 23, 2021

0.0.7 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 11, 2021

0.0.6 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.5 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.4 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 07, 2021

0.0.3 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Feb 02, 2021

0.0.2 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 10, 2021

0.0.1 unknown

1 CVE

CVE-2026-35341 GHSA-pmf6-rcx4-v53v Jul 06, 2026

mkfifo: permissions of an existing file are changed after FIFO creation fails

7.1 / 10

High

Local Low Low None Unchanged High High None

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 31, 2020

Activity

Reach

Details