{"id":"EUVD-2026-25016","enisaUuid":"eba85b20-1ad9-3bbd-9145-90699d5d1f31","description":"A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.","datePublished":"Apr 22, 2026, 4:08:48 PM","dateUpdated":"Apr 25, 2026, 3:55:34 AM","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10327\n","aliases":"CVE-2026-35368\n","assigner":"canonical","epss":0.14,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"41efa632-d454-397c-8b1b-f27721a2be04","vulnerability":{"id":"CVE-2026-35368","description":"A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.","datePublished":"Apr 22, 2026, 4:08:48 PM","dateUpdated":"Apr 25, 2026, 3:55:34 AM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10327\n","enisa_id":"EUVD-2026-25016\n","assigner":"canonical","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7e83d7ca-9b48-305f-b877-5280ed5035e7","vulnerability":{"id":"GHSA-mh5c-xrmh-m794","description":"uutils coreutils has an Untrusted Search Path","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Apr 30, 2026, 5:50:13 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35368\nhttps://github.com/uutils/coreutils/issues/10327\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25016\n","aliases":"GHSA-mh5c-xrmh-m794\nCVE-2026-35368\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}