{"cve":"CVE-2026-35380","nvd":{"published":"2026-04-22T17:16:43.047","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.5},"cwes":["CWE-20"],"references":["https://github.com/uutils/coreutils/pull/11399","https://github.com/uutils/coreutils/releases/tag/0.8.0"],"products":["uutils:coreutils"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-35380","score":0.00157,"percentile":0.04845,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-m2pg-c7m6-77pj","url":"https://osv.dev/vulnerability/GHSA-m2pg-c7m6-77pj","summary":"uutils coreutils has an Improper Input Validation Issue in its cut Utility","modified":"2026-05-05T16:11:51.199920Z","packages":[{"ecosystem":"crates.io","name":"coreutils","purl":"pkg:cargo/coreutils","ranges":["<0.8.0"],"fixed":["0.8.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}