Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. coreutils
  4. ›
  5. CVE-2026-35340

CVE-2026-35340: uutils coreutils has an Incorrect Check of Function Return Value

April 22, 2026 (updated April 29, 2026)

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

References

  • github.com/advisories/GHSA-88ch-q68x-36v7
  • github.com/uutils/coreutils
  • github.com/uutils/coreutils/commit/ebc08af9c34138f474b32ea0ef34bed3b086a3ed
  • github.com/uutils/coreutils/pull/10035
  • github.com/uutils/coreutils/releases/tag/0.6.0
  • nvd.nist.gov/vuln/detail/CVE-2026-35340

Code Behaviors & Features

Detect and mitigate CVE-2026-35340 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.6.0

Fixed versions

  • 0.6.0

Solution

Upgrade to version 0.6.0 or above.

Impact 5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-253: Incorrect Check of Function Return Value

Source file

cargo/coreutils/CVE-2026-35340.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:18:16 +0000.