CVE-2026-35377

Executive Summary

CVE-2026-35377 is a logic error in the env utility of the uutils coreutils project, a Rust-based reimplementation of GNU coreutils. The vulnerability specifically affects the -S (split-string) option, which is used to parse command-line arguments from a single string. In GNU env, backslashes within single quotes are treated literally, with the only exceptions being // and /'. However, the uutils implementation incorrectly validates these sequences, causing it to reject valid escape sequences like /a or /x as "invalid sequence" errors. This results in immediate process termination with an exit status of 125, leading to a local denial of service for automated scripts and administrative workflows that rely on standard split-string semantics.

The vulnerability has a CVSS score of 3.3 (Low), with an EPSS score of 0.0%, indicating very low exploitation probability. No public proof-of-concept or exploit code is available. The patch status is unknown, and no official fix has been released.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed as a Rust crate (uutils-coreutils) on crates.io and as a system package in some Linux distributions. Users who have installed uutils coreutils as a replacement for GNU coreutils are affected. The vulnerability is in the env utility, which is a core component of the package. Supply chain risk is low due to the low severity and lack of remote exploitation vector, but users should monitor for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L) - The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) - No data is exposed.
• Integrity Impact: None (I:N) - No data is modified.
• Availability Impact: Low (A:L) - The env utility terminates unexpectedly, causing a denial of service for the specific command.

Threat Level: Low. The vulnerability is local, requires no privileges, and only causes a denial of service for the env utility. It is unlikely to be exploited in the wild.

Deep Dive & Mechanics

The vulnerability lies in the argument parsing logic of the env utility when the -S (split-string) option is used. The -S option allows users to pass a single string that is then split into multiple arguments, similar to how a shell would parse a command line. In GNU env, backslashes within single quotes are treated literally, meaning they are not interpreted as escape characters. The only exceptions are // (which represents a literal backslash) and /' (which represents a literal single quote).

In the uutils implementation, the parser incorrectly attempts to validate escape sequences within single quotes. When it encounters a backslash followed by a character that is not \ or ', it raises an "invalid sequence" error and terminates the process with exit code 125. This behavior is incorrect because GNU env treats all other backslash sequences as literal characters.

For example, the command:

env -S 'echo /a'

would work in GNU env, printing /a, but in uutils env, it would fail with an "invalid sequence" error.

The root cause is a logic error in the state machine that parses the split-string. The parser enters a "single-quoted" state and then, when encountering a backslash, incorrectly checks for valid escape sequences instead of treating the backslash literally.

Vulnerable vs. Patched Code

The vulnerable code is in the env utility's argument parsing logic. The exact location is unknown, but the logic is likely in the function that handles the -S option.

Vulnerable Code (Conceptual):

// Pseudo-code for vulnerable implementation
fn parse_split_string(input: &str) -> Result<Vec<String>, Error> {
    let mut args = Vec::new();
    let mut current = String::new();
    let mut in_single_quotes = false;
    let mut chars = input.chars().peekable();

    while let Some(c) = chars.next() {
        if in_single_quotes {
            if c == '\\' {
                let next = chars.next();
                match next {
                    Some('\\') => current.push('\\'),
                    Some('\'') => current.push('\''),
                    Some(other) => {
                        // VULNERABLE: Rejects valid sequences like /a
                        return Err(Error::InvalidSequence(format!("\\{}", other)));
                    }
                    None => return Err(Error::InvalidSequence("\\".to_string())),
                }
            } else if c == '\'' {
                in_single_quotes = false;
            } else {
                current.push(c);
            }
        } else {
            // ... handle other states
        }
    }
    Ok(args)
}

Patched Code (Conceptual):

// Pseudo-code for patched implementation (GNU-compatible)
fn parse_split_string(input: &str) -> Result<Vec<String>, Error> {
    let mut args = Vec::new();
    let mut current = String::new();
    let mut in_single_quotes = false;
    let mut chars = input.chars().peekable();

    while let Some(c) = chars.next() {
        if in_single_quotes {
            if c == '\\' {
                let next = chars.next();
                match next {
                    Some('\\') => current.push('\\'),
                    Some('\'') => current.push('\''),
                    Some(other) => {
                        // PATCHED: Treat backslash literally, push both characters
                        current.push('\\');
                        current.push(other);
                    }
                    None => {
                        current.push('\\');
                    }
                }
            } else if c == '\'' {
                in_single_quotes = false;
            } else {
                current.push(c);
            }
        } else {
            // ... handle other states
        }
    }
    Ok(args)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with uutils coreutils installed.
• The env utility must be the uutils version (not GNU).

Exploitation Steps:

1. Identify if the system uses uutils env:

   env --version | grep -i uutils
   

2. Craft a command that triggers the vulnerability:

   env -S 'echo /a'
   

3. Observe the error:

   env: invalid sequence \a
   

4. The command will exit with code 125, causing a denial of service for any script that uses this pattern.

Impact: Local denial of service for scripts that use env -S with backslash sequences inside single quotes.

Blue Team

Detection:

• Monitor for env processes that exit with code 125.
• Look for log entries containing "invalid sequence" from the env utility.
• Audit scripts that use env -S with backslash sequences.

Hunting:

• Search for env -S usage in shell scripts:

  grep -r "env -S" /etc /opt /usr/local
  

• Check for error messages in system logs:

  journalctl | grep "invalid sequence"
  

Mitigation:

• Replace uutils env with GNU env if possible.
• Modify scripts to avoid using backslash sequences inside single quotes with env -S.
• Apply patches when available.

Indicators of Compromise (IOCs)

• Process: env exiting with code 125
• Log Entry: env: invalid sequence \a (or similar)
• Command: env -S '...' containing backslash sequences inside single quotes
• File: Any script that uses env -S with backslash sequences

Detection Engineering

YARA Rule

rule CVE_2026_35377_uutils_env_invalid_sequence {
    meta:
        description = "Detects uutils env utility with invalid sequence error"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35377"
        severity = "low"
    strings:
        $error_msg = "invalid sequence"
        $env_binary = "env"
    condition:
        $error_msg and $env_binary
}

Sigma Rule

title: Uutils env Invalid Sequence Error
id: cve-2026-35377
status: experimental
description: Detects uutils env utility terminating with invalid sequence error
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35377
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/env'
        ExitCode: 125
    condition: selection
falsepositives:
    - Unknown
level: low

Suricata Rule

alert ip any any -> any any (msg:"CVE-2026-35377 Uutils env Invalid Sequence"; content:"invalid sequence"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Replace uutils env with GNU env:

   sudo apt-get install coreutils  # For Debian/Ubuntu
   sudo yum install coreutils      # For RHEL/CentOS
   

2. Modify scripts to avoid using backslash sequences inside single quotes with env -S.
3. Use alternative methods for argument splitting, such as xargs or shell arrays.

Long-term Remediation:

1. Monitor the uutils project for a patch.
2. Apply the patch when available.
3. Consider using GNU coreutils instead of uutils for production environments.

Workaround:

• If you must use uutils env, avoid backslash sequences inside single quotes. For example, instead of:

  env -S 'echo /a'
  

  Use:

  env -S 'echo //a'
  

  (Note: This may not work in all cases.)

Valters IT

{/* [Security Hash: 7C6971D08F4B6361B77059B0] */}