Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93658

uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid

CVSS 4.0 7.3 HIGHCVSS 3.1 7.0 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93658

Published

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93658

Published

coreutils

https://crates.io

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "uutils",
                    "product": "coreutils",
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://crates.io",
                    "packageName": "coreutils",
                    "packageURL": "pkg:cargo/coreutils",
                    "repo": "https://github.com/uutils/coreutils",
                    "platforms": [
                        "Linux",
                        "Unix",
                        "macOS"
                    ],
                    "versions": [
                        {
                            "version": "0.0.18",
                            "lessThan": "0.10.0",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "0.10.0",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON