GitHub Advisoryadvisory · crates.io

GHSA-w6xc-g9qj-vp32 uucore: safe_traversal TOCTOU protection only enabled on Linux

LOW Published 2026-07-06 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-35362
Ecosystem
crates.io
Packages
uucore
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-367
Reviewed
2026-07-06

Affected packages

• crates.io uucore: < 0.6.0 → fixed in 0.6.0

Description

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions. --- _Zellic finding 3.59. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

Related

Alias · CVE (1)

  • CVE-2026-35362 The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References