CVE-2026-35343: uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation

April 22, 2026 (updated April 29, 2026)

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

References

github.com/advisories/GHSA-hj9r-8pfm-rmjj
github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7
github.com/uutils/coreutils/pull/11143
github.com/uutils/coreutils/releases/tag/0.7.0
nvd.nist.gov/vuln/detail/CVE-2026-35343

Code Behaviors & Features

Detect and mitigate CVE-2026-35343 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →