GHSA-pmfc-4wjj-gmhx

Suggest an improvement
Source
https://github.com/advisories/GHSA-pmfc-4wjj-gmhx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-pmfc-4wjj-gmhx/GHSA-pmfc-4wjj-gmhx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pmfc-4wjj-gmhx
Aliases
Published
2026-07-06T21:54:29Z
Modified
2026-07-06T22:00:08.973314002Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
cut: -s ignored in -z -d '' newline-delimiter mode
Details

cut routes -z -d '' through a special newline-delimiter path that ignores the -s only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on cut -s to drop undelimited records process data that should be filtered.

printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1   # GNU: no output ; uutils: 61 62 63 00

Zellic private finding (zellic-ext/coreutils-private PR #102). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Database specific 
{
    "cwe_ids": [
        "CWE-684"
    ],
    "severity": "LOW",
    "github_reviewed_at": "2026-07-06T21:54:29Z",
    "github_reviewed": true,
    "nvd_published_at": null
}
References

Affected packages

crates.io / uu_cut

Package

Name
uu_cut
View open source insights on deps.dev
Purl
pkg:cargo/uu_cut

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-pmfc-4wjj-gmhx/GHSA-pmfc-4wjj-gmhx.json"