What’s Vulnerable › Vulnerabilities

CVE-2026-35343: uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-670

Description

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Affected products

• Uutils coreutils: before 0.7.0 — fixed in 0.7.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/uutils/coreutils/pull/11143
• https://github.com/uutils/coreutils/releases/tag/0.7.0

Get alerted when CVE-2026-35343 or the next vulnerability affects your stack