GHSA-5hgf-628x-mcqf — low GitHub Advisory (CVE-2026-35367) in rust/coreutils

Description

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

Basic information

Type: reviewed
Severity: low
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2026-04-22 18:31:45 UTC
Updated: 2026-04-30 17:50:53 UTC
GitHub reviewed: 2026-04-30 17:50:53 UTC
NVD published: 2026-04-22

Score	Percentile
0.01%	1.27%

CVSS Scores

Base score	Version	Severity	Vector
3.3	3.1	—	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.

Identifiers

Type	Value
GHSA	GHSA-5hgf-628x-mcqf ↗
CVE	CVE-2026-35367 ↗

CWEs

CWE id	Name
CWE-732	Incorrect Permission Assignment for Critical Resource

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
rust	coreutils	<= 0.8.0	—	—

uutils coreutils has an Incorrect Permission Assignment for Critical Resource