CVE-2026-35381 uutils coreutils cut逻辑错误漏洞

#!/bin/bash # PoC for CVE-2026-35381 # Demonstrates that uutils cut ignores -s flag with -z and -d '' echo "Testing CVE-2026-35381..." # Create a test file with data containing no delimiter (empty delimiter is used) # Using printf to ensure NUL byte handling is clear if needed, though here we test the suppression. # Input: "nodelim" followed by NUL # Expected behavior (GNU coreutils): No output because -s suppresses lines without delimiters. # Vulnerable behavior (uutils): Outputs "nodelim" + NUL byte. printf "nodelim\0" | ./cut -s -z -d '' -f1 # If output is visible, the vulnerability is present. echo "If 'nodelim' was printed above, the漏洞 is triggered."