CVE-2026-35371
uutils coreutils id Misleading Identity Reporting in Pretty Print Mode
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
uutils coreutils id Misleading Identity Reporting in Pretty Print Mode
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
CVE-2026-35371- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
EUVDEUVD-2026-25019
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
EUVD-2026-25019- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-53gr-wmf4-8hh3
Duplicate Advisory: uutils coreutils's User Interface (UI) Misrepresents Critical Information
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xv5w-cw7x-72gj. This link is maintained to preserve external references.
Original Description
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
GHSA-53gr-wmf4-8hh3- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xv5w-cw7x-72gj
id: pretty-print uses effective GID instead of effective UID for name lookup
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
Zellic finding 3.73. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
- Record
GHSA-xv5w-cw7x-72gj- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
NVD
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
CVE-2026-35371- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-35371
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
DEBIAN-CVE-2026-35371- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-53gr-wmf4-8hh3
Duplicate Advisory: uutils coreutils's User Interface (UI) Misrepresents Critical Information
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xv5w-cw7x-72gj. This link is maintained to preserve external references.
Original Description
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
GHSA-53gr-wmf4-8hh3- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVGHSA-xv5w-cw7x-72gj
id: pretty-print uses effective GID instead of effective UID for name lookup
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
Zellic finding 3.73. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
- Record
GHSA-xv5w-cw7x-72gj- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-35371
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
- Record
UBUNTU-CVE-2026-35371- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uu_idcrates.io |
before 0.6.0 | 0.6.0 |
rust-coreutilsDebian:12 |
All versions, plus listed versions 0.0.17-20.0.17-30.0.17-40.0.17-50.0.17-6 Show 39 moreShow less0.0.19-10.0.19-20.0.19-30.0.20-10.0.21-10.0.22-10.0.23-10.0.23-20.0.23-30.0.24-10.0.24-20.0.26-10.0.26-20.0.26-30.0.26-40.0.26-50.0.27-10.0.27-20.0.27-30.0.30-10.0.30-20.0.30-30.0.30-3~exp10.0.30-40.10.0-10.11.0-10.11.0-20.12.0-10.6.0-10.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
None known |
rust-coreutilsDebian:13 |
All versions, plus listed versions 0.0.30-20.0.30-30.0.30-3~exp10.0.30-40.10.0-1 Show 14 moreShow less0.11.0-10.11.0-20.12.0-10.6.0-10.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
None known |
rust-coreutilsDebian:14 |
All versions, plus listed versions 0.0.30-20.0.30-30.0.30-3~exp10.0.30-40.10.0-1 Show 14 moreShow less0.11.0-10.11.0-20.12.0-10.6.0-10.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
None known |
rust-coreutilsUbuntu:24.04:LTS |
All versions, plus listed versions 0.0.20-10.0.22-10.0.23-10.0.23-20.0.23-30.0.24-10.0.24-2 |
None known |
rust-coreutilsUbuntu:25.10 |
All versions, plus listed versions 0.0.30-10.0.30-20.0.30-2ubuntu20.1.0-0ubuntu10.1.0+git20250711.2ba3a33-0ubuntu1 Show 11 moreShow less0.1.0+git20250711.2ba3a33-0ubuntu20.1.0+git20250711.2ba3a33-0ubuntu30.1.0+git20250711.2ba3a33-0ubuntu40.1.0+git20250801.cf79675-0ubuntu10.1.0+git20250813.4af2a84-0ubuntu20.1.0+git20250813.4af2a84-0ubuntu40.1.0+git20250813.4af2a84-0ubuntu60.1.0+git20250813.4af2a84-0ubuntu70.2.2-0ubuntu10.2.2-0ubuntu20.2.2-0ubuntu2.1 |
None known |
rust-coreutilsUbuntu:26.10 |
All versions, plus listed versions 0.8.0-0ubuntu30.8.0-0ubuntu40.9.0-2ubuntu20.10.0-1ubuntu10.10.0-1ubuntu2 Show 5 moreShow less0.10.0-1ubuntu30.11.0-2ubuntu10.11.0-2ubuntu20.12.0-1ubuntu10.12.0-1ubuntu2 |
None known |
rust-coreutilsUbuntu:26.04:LTS |
All versions, plus listed versions 0.2.2-0ubuntu20.2.2-0ubuntu40.5.0-0ubuntu10.5.0-0ubuntu20.6.0-0ubuntu10.7.0-0ubuntu10.8.0-0ubuntu30.10.0-1ubuntu2~26.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35371 is a low vulnerability (CVSS 3.3) in Uutils Coreutils, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in uu_id 0.6.0.
References
github.com/uutils/coreutils/issues/10006
nvd.nist.gov/vuln/detail/CVE-2026-35371
security-tracker.debian.org/tracker/CVE-2026-35371
ubuntu.com/security/CVE-2026-35371
cve.org/CVERecord?id=CVE-2026-35371