GitHub Advisoryadvisory · crates.io

GHSA-p7h3-7q52-72w8 printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

MEDIUM Published 2026-07-06 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-35366
Ecosystem
crates.io
Packages
uu_printenv
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-116, CWE-754
Reviewed
2026-07-06

Affected packages

• crates.io uu_printenv: < 0.6.0 → fixed in 0.6.0

Description

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected. --- _Zellic finding 3.66. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

Related

Alias · CVE (1)

  • CVE-2026-35366 The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References