uutils Coreutils Vulnerability Details and Proof-of-Concept Published for Translation-File Code Injection
Do Son 
TL;DR
Researcher JoeCyberTech has published full details and a proof-of-concept for a critical uutils coreutils vulnerability, rated CVSS 9.9. The bug let a crafted translation file inject Rust code into the core utilities at build time. Maintainers fixed it in uucore 0.12.0.
uucore’s build script pasted Fluent translation text into a Rust raw string without proper escaping. A translation containing the two characters “# could close that string and turn the rest into compiled code. Upgrade to uucore 0.12.0 or later.
Why It Matters
uutils is the Rust rewrite of the GNU core utilities, such as ls, cp and cat. According to the researcher, it “now ships as the default coreutils in mainstream Linux distributions.” Every utility links the shared uucore crate, which crates.io lists with over 2.5 million downloads.
As a result, one merged pull request could plant a backdoor in trusted system binaries. The researcher warns that “a file that every reviewer treats as harmless text was, in practice, a path to a supply-chain backdoor.” No malicious translation has been found in the wild.
How the Attack Works
A Rust raw string opened with r#” “simply ends at the first byte pair “#.” The build script only checked whether a translation contained a double quote. It never checked for the terminator itself. Consequently, everything after an early “# is “parsed by rustc as code.”
The public proof-of-concept adds a shell command to a harmless-looking message. Moreover, 34 of the 214 translation files already contained quotes, and the project’s linter had its quote check turned off.
Affected Versions
The GitHub advisory lists uucore 0.2.2 through 0.11.0 as affected.
Patch and Mitigation
- Upgrade to uutils coreutils and uucore 0.12.0, released on September 17, 2026.
- Rebuild packages from a fixed source tree.
- Audit any vendored .ftl files for the “# character pair.
The fix lets Rust’s Debug formatter escape every quote, so the exploit string “becomes inert data.” Read JoeCyberTech’s full write-up on the uucore FTL injection to learn more about this uutils coreutils vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
