GHSA-v762-x3cf-5mfg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v762-x3cf-5mfg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-v762-x3cf-5mfg/GHSA-v762-x3cf-5mfg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v762-x3cf-5mfg
- Aliases
-
- CVE-2026-35349
- Published
- 2026-04-22T18:31:45Z
- Modified
- 2026-05-05T16:11:11.026754Z
- Severity
-
- 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- uutils coreutils has a Link Following Issue Via rm Utility
- Details
-
A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.
- Database specific
{ "cwe_ids": [ "CWE-59" ], "github_reviewed": true, "github_reviewed_at": "2026-04-29T23:13:17Z", "nvd_published_at": "2026-04-22T17:16:37Z", "severity": "MODERATE" }- References
Affected packages
crates.io / coreutils
Package
- Name
- coreutils
- View open source insights on deps.dev
- Purl
- pkg:cargo/coreutils