GitHub Advisoryadvisory · crates.io

GHSA-f2jv-wjjc-2c94 uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths

MEDIUM Published 2026-04-22 Modified 2026-04-29 Official page ↗
Aliases
CVE-2026-35348
Ecosystem
crates.io
Packages
coreutils
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248
Reviewed
2026-04-29

Affected packages

• crates.io coreutils: <= 0.8.0 (no fix yet)

Description

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Related

Alias · CVE (1)

  • CVE-2026-35348 The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8… vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References