GHSA-6gcw-w7cp-94g9

Suggest an improvement
Source
https://github.com/advisories/GHSA-6gcw-w7cp-94g9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-6gcw-w7cp-94g9/GHSA-6gcw-w7cp-94g9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6gcw-w7cp-94g9
Aliases
Published
2026-07-06T19:51:22Z
Modified
2026-07-06T20:11:29Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output
Details

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Zellic finding 3.34. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Database specific 
{
    "cwe_ids":  [
        "CWE-116",
        "CWE-176"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-06T19:51:22Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

crates.io / uu_comm

Package

Name
uu_comm
View open source insights on deps.dev
Purl
pkg:cargo/uu_comm

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-6gcw-w7cp-94g9/GHSA-6gcw-w7cp-94g9.json"