GHSA-m26v-hjq3-x245

Source

https://github.com/advisories/GHSA-m26v-hjq3-x245

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m26v-hjq3-x245/GHSA-m26v-hjq3-x245.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m26v-hjq3-x245

Aliases

CVE-2026-35356

Published

2026-04-22T18:31:45Z

Modified

2026-05-05T16:08:35.882419Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

Details

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

Database specific

{
    "cwe_ids": [
        "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-30T17:12:52Z",
    "nvd_published_at": "2026-04-22T17:16:38Z",
    "severity": "MODERATE"
}

References

Affected packages

crates.io / coreutils

Package

Name: coreutils; View open source insights on deps.dev
Purl: pkg:cargo/coreutils

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m26v-hjq3-x245/GHSA-m26v-hjq3-x245.json"