GHSA-wh8p-h9hw-x2mc

Source

https://github.com/advisories/GHSA-wh8p-h9hw-x2mc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wh8p-h9hw-x2mc/GHSA-wh8p-h9hw-x2mc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wh8p-h9hw-x2mc

Aliases

CVE-2026-35344

Downstream

CGA (212)

Published

2026-04-22T18:31:45Z

Modified

2026-09-10T03:50:44Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

uutils coreutils has an Unchecked Return Value Issue

Details

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Database specific

{
    "cwe_ids":  [
        "CWE-252"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-29T23:00:44Z",
    "nvd_published_at":  "2026-04-22T17:16:36Z",
    "severity":  "LOW"
}

References

Affected packages

crates.io / coreutils

Package

Name: coreutils; View open source insights on deps.dev
Purl: pkg:cargo/coreutils

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.8.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wh8p-h9hw-x2mc/GHSA-wh8p-h9hw-x2mc.json"