CVE-2026-35371

Summary

id: pretty-print uses effective GID instead of effective UID for name lookup

Severity

low

CVSS

3.3

EPSS

0.1% (p2)

CWE

CWE-451

Also known as

GHSA-53gr-wmf4-8hh3, GHSA-xv5w-cw7x-72gj

Published

2026-07-06

Updated

2026-07-06

Advisory details

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Zellic finding 3.73. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

References

• https://github.com/advisories/GHSA-xv5w-cw7x-72gj
• https://github.com/uutils/coreutils/security/advisories/GHSA-xv5w-cw7x-72gj
• https://nvd.nist.gov/vuln/detail/CVE-2026-35371
• https://github.com/uutils/coreutils/issues/10006

Related advisories

• CVE-2026-35370 — medium · crates.io/uu_id
• WEB3-BLIND-SIGNING-2024 — critical · Web3 · Wallets/Blind signing of opaque transactions and messages
• WEB3-PERMIT-PHISHING-2024 — critical · Web3 · Ethereum/EIP-2612 Permit and Uniswap Permit2 signature phishing
• WEB3-DRAINER-2024 — critical · Web3 · Wallets/Wallet drainer-as-a-service kits
• WEB3-ADDRESS-POISONING-2024 — high · Web3 · Wallets/Address poisoning / transaction-history spoofing
• WEB3-APPROVAL-PHISHING-2023 — high · Web3 · Ethereum/Unlimited ERC-20 approvals and ERC-721/1155 setApprovalForAll phishing

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity