GHSA-532v-xp3f-837c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-532v-xp3f-837c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-532v-xp3f-837c/GHSA-532v-xp3f-837c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-532v-xp3f-837c
- Withdrawn
- 2026-07-06T21:54:21Z
- Published
- 2026-04-22T18:31:46Z
- Modified
- 2026-09-10T03:50:42Z
- Severity
-
- 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Duplicate Advisory: uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut Utility
- Details
-
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pmfc-4wjj-gmhx. This link is maintained to preserve external references.
Original Description
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.
- Database specific
{ "cwe_ids": [ "CWE-684" ], "github_reviewed": true, "github_reviewed_at": "2026-04-30T18:05:52Z", "nvd_published_at": "2026-04-22T17:16:43Z", "severity": "LOW" }- References
Affected packages
crates.io / coreutils
Package
- Name
- coreutils
- View open source insights on deps.dev
- Purl
- pkg:cargo/coreutils