CVE-2026-35362: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

April 22, 2026 (updated April 30, 2026)

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

References

github.com/advisories/GHSA-ggc5-46rg-mr4v
github.com/uutils/coreutils/commit/30239e69a328e76d2377f2a0bc02fbde61c34280
github.com/uutils/coreutils/pull/9792
github.com/uutils/coreutils/releases/tag/0.6.0
nvd.nist.gov/vuln/detail/CVE-2026-35362

Code Behaviors & Features

Detect and mitigate CVE-2026-35362 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →