{"cve":"CVE-2026-35366","nvd":{"published":"2026-04-22T17:16:40.167","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.4},"cwes":["CWE-754"],"references":["https://github.com/uutils/coreutils/issues/9701","https://github.com/uutils/coreutils/pull/9728","https://github.com/uutils/coreutils/releases/tag/0.6.0","https://github.com/uutils/coreutils/issues/9701"],"products":["uutils:coreutils"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-35366","score":0.0017,"percentile":0.06401,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-p7h3-7q52-72w8","url":"https://osv.dev/vulnerability/GHSA-p7h3-7q52-72w8","summary":"printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)","modified":"2026-07-06T20:41:30.095135Z","packages":[{"ecosystem":"crates.io","name":"uu_printenv","purl":"pkg:cargo/uu_printenv","ranges":["<0.6.0"],"fixed":["0.6.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}