Researcher details code injection flaw in uutils Coreutils

SecurityOnline[.]info reports that researcher JoeCyberTech has published full vulnerability details and a proof-of-concept for a critical flaw in the uutils coreutils project, rated CVSS 9.9. The issue enables code injection into the Rust-based core utilities via translation files during build time. The GitHub advisory identifies affected versions as uucore 0.2.2 through 0.11.0, with a fix in uucore 0.12.0.

Evidence cited includes a Rust raw string in the build script that was not properly escaped, allowing a translation containing the terminator sequence to be parsed by Rust as code. The PoC reportedly demonstrates adding a shell command to a seemingly harmless translation message, and notes that 34 of 214 translation files already contained quotes while the project’s linter’s quote check was disabled. No malicious translation has yet been observed in the wild.

Mitigation and practical response centre on upgrading to uutils coreutils and uucore 0.12.0, released on 17 September 2026, and rebuilding packages from a fixed source tree. Organisations are advised to audit vendored .ftl files for the problematic “#” termination sequence. The fix reportedly causes Rust’s Debug formatter to escape quotes, rendering the exploit string inert. For deeper detail, the article directs readers to JoeCyberTech’s full write-up on the uucore FTL injection. No indication of exploitation outside the PoC is provided, and claims are attributed to the researcher and the advisory, not to the article itself.