CVE-2026-35377

Medium

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

A logic error in the env utility of uutils coreutils causes incorrect parsing of command-line arguments when using the -S (split-string) option. Unlike GNU env, the uutils implementation mishandles backslashes within single quotes, leading to incompatibility.

Risk Assessment

Organizations may face portability issues in scripts and automation relying on predictable env behavior, potentially causing configuration errors or unexpected system behavior.

Recommendation

Update uutils coreutils to the latest patched version and temporarily avoid using the -S option in production scripts.

Original NVD description (English source)

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \\ and \'). However, the uutils implementation incor