CVE-2026-93658

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93658", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-18T13:30:25.933Z", "datePublished": "2026-09-18T14:23:20.877Z", "dateUpdated": "2026-09-18T16:48:03.334Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-18T14:23:20.877Z"}, "datePublic": "2026-09-16T18:21:36.000Z", "title": "uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid", "descriptions": [{"lang": "en", "value": "uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Preservation of Permissions", "cweId": "CWE-281", "type": "CWE"}]}], "affected": [{"vendor": "uutils", "product": "coreutils", "defaultStatus": "unaffected", "collectionURL": "https://crates.io", "packageName": "coreutils", "packageURL": "pkg:cargo/coreutils", "repo": "https://github.com/uutils/coreutils", "platforms": ["Linux", "Unix", "macOS"], "versions": [{"version": "0.0.18", "lessThan": "0.10.0", "status": "affected", "versionType": "semver"}, {"version": "0.10.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.10.0", "versionStartIncluding": "0.0.18"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-cgg3-923w-v53m)"}, {"url": "https://github.com/uutils/coreutils/pull/13629", "tags": ["patch", "issue-tracking"], "name": "Pull Request #13629"}, {"url": "https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs", "tags": ["technical-description"], "name": "Vulnerable install.rs at 0.9.0"}, {"url": "https://github.com/uutils/coreutils", "tags": ["product"]}, {"name": "VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid"}], "credits": [{"lang": "en", "value": "Ali Firas (thesmartshadow)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T16:45:19.868483Z", "id": "CVE-2026-93658", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T16:48:03.334Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93658", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-18T16:45:19.868483Z"}}}], "references": [{"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T16:47:56.616Z"}}], "cna": {"title": "uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid", "credits": [{"lang": "en", "type": "finder", "value": "Ali Firas (thesmartshadow)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/uutils/coreutils", "vendor": "uutils", "product": "coreutils", "versions": [{"status": "affected", "version": "0.0.18", "lessThan": "0.10.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.10.0", "versionType": "semver"}], "platforms": ["Linux", "Unix", "macOS"], "packageURL": "pkg:cargo/coreutils", "packageName": "coreutils", "collectionURL": "https://crates.io", "defaultStatus": "unaffected"}], "datePublic": "2026-09-16T18:21:36.000Z", "references": [{"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m", "name": "GitHub Security Advisory (GHSA-cgg3-923w-v53m)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/uutils/coreutils/pull/13629", "name": "Pull Request #13629", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs", "name": "Vulnerable install.rs at 0.9.0", "tags": ["technical-description"]}, {"url": "https://github.com/uutils/coreutils", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid", "name": "VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-281", "description": "Improper Preservation of Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.10.0", "versionStartIncluding": "0.0.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-18T14:23:20.877Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93658", "state": "PUBLISHED", "dateUpdated": "2026-09-18T16:48:03.334Z", "dateReserved": "2026-09-18T13:30:25.933Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-18T14:23:20.877Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crates.io", "defaultStatus": "unaffected", "packageName": "coreutils", "packageURL": "pkg:cargo/coreutils", "platforms": ["Linux", "Unix", "macOS"], "product": "coreutils", "repo": "https://github.com/uutils/coreutils", "vendor": "uutils", "versions": [{"lessThan": "0.10.0", "status": "affected", "version": "0.0.18", "versionType": "semver"}, {"status": "unaffected", "version": "0.10.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems."}], "id": "CVE-2026-93658", "lastModified": "2026-09-22T20:25:55.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93658", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T16:45:19.868483Z", "version": "2.0.3"}}]}, "published": "2026-09-18T15:17:22.360", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/uutils/coreutils"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/uutils/coreutils/pull/13629"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-281"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rust-coreutils: uutils coreutils: Privilege Escalation via setuid/setgid handling", "id": "2538898", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538898"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-279", "details": ["uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.", "A flaw was found in uutils coreutils. When installing files, the software applies `setuid` or `setgid` permissions before finalizing ownership changes. This can allow a privileged user to inadvertently leave behind executable files with elevated privileges if the ownership change operation fails on systems with restricted capabilities. A local attacker could then exploit these leftover files to achieve privilege escalation."], "name": "CVE-2026-93658", "public_date": "2026-09-18T14:23:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93658\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93658\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs\nhttps://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55\nhttps://github.com/uutils/coreutils/pull/13629\nhttps://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m\nhttps://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid"], "statement": "Moderate: The `uutils coreutils` `install` utility can create root-owned setuid/setgid executables if ownership changes fail during installation in capability-restricted environments. This flaw allows a local attacker to execute these leftover files with elevated privileges.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["linux", "unix", "macos"], "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.18,0.10.0)"}}, {"platform": ["linux", "unix", "macos"], "status": "unaffected", "versions": {"scheme": "semver", "value": "0.10.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "coreutils", "source": "cna", "vendor": "uutils"}, "product": "coreutils", "vendor": "uutils"}], "created": "2026-09-18T23:15:17.098154+00:00", "updated": "2026-09-23T14:15:06.445102+00:00", "vendors": ["uutils", "uutils$PRODUCT$coreutils"]}