CVE-2026-35343 uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters
The cut utility fails to suppress non-delimited lines when using newline delimiters, potentially leaking unexpected data to downstream scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35343?
CVE-2026-35343 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
Weakness: CWE-670
Which versions are affected by CVE-2026-35343?
2 open source packages ship an affected version, including uu_cut. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uu_cut crates.io | All versions | 0.7.0 |
uu_cut crates.io | All versions | 0.7.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35343?
Upgrade uu_cut to 0.7.0 or later.
Is CVE-2026-35343 being exploited?
There is no known exploitation of CVE-2026-35343 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35343, GHSA-wv33-5pxh-r7j7, UBUNTU-CVE-2026-35343.