UBUNTU-CVE-2026-35377: Low severity ubuntu/rust-coreutils vulnerability
A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \\ and \'). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Ubuntu's rust-coreutils package are affected when scripts or administrative workflows invoke env with the -S option and include valid backslash sequences inside single-quoted text that uutils rejects, such as \a or \x.
What does an attacker need to exploit it?
Exploitation requires local access and low privileges, plus the ability to cause an affected env -S invocation to process the problematic arguments. No user interaction is required.
How can I tell whether a workflow is affected?
Affected invocations terminate immediately with an "invalid sequence" error and exit status 125 when env -S encounters an unrecognized backslash sequence within single quotes. This can disrupt scripts that expect GNU env split-string behavior.