GHSA-5hgf-628x-mcqf

Suggest an improvement
Source
https://github.com/advisories/GHSA-5hgf-628x-mcqf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5hgf-628x-mcqf/GHSA-5hgf-628x-mcqf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5hgf-628x-mcqf
Aliases
  • CVE-2026-35367
Related
Published
2026-04-22T18:31:45Z
Modified
2026-06-02T13:29:23.752121493Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
uutils coreutils has an Incorrect Permission Assignment for Critical Resource
Details

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2026-04-22T17:16:40Z",
    "severity": "LOW",
    "github_reviewed_at": "2026-04-30T17:50:53Z",
    "cwe_ids": [
        "CWE-732"
    ]
}
References

Affected packages

crates.io / coreutils

Package

Name
coreutils
View open source insights on deps.dev
Purl
pkg:cargo/coreutils

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.8.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5hgf-628x-mcqf/GHSA-5hgf-628x-mcqf.json"