CVE-2026-35377

What it actually does

The flaw is a local denial-of-service condition in the uutils coreutils implementation of `env` when the `-S` / `--split-string` option is used. uutils incorrectly validates backslash escape sequences inside single-quoted split strings, diverging from GNU `env` behavior where most backslashes inside single quotes are treated literally. Valid inputs such as `\a` or `\x` can therefore be rejected as an `invalid sequence`, causing `env` to terminate immediately with exit status 125 before launching the intended command. The impact is availability-only: it does not provide code execution, privilege escalation, data disclosure, or integrity modification by itself.

Why it matters to the business

Systems and automation that depend on uutils coreutils rather than GNU coreutils may experience failed scripts, broken scheduled jobs, interrupted administrative workflows, or failed build/deployment tasks when affected `env -S` syntax is used. The severity is relatively low because exploitation requires local access or the ability to influence command-line/script content, and public exploitation is not currently reported; EPSS is very low and stable. However, organizations with broad use of uutils coreutils in developer workstations, containers, embedded systems, or minimal Linux environments may see operational disruption if compatible GNU-style scripts are introduced.

How an attack unfolds

An attacker first needs local access or another path to influence a script, job definition, wrapper, package script, container entrypoint, or administrative command that invokes uutils `env` with the `-S` option. The attacker supplies or causes execution of a split-string argument containing a backslash sequence inside single quotes that GNU `env` would accept literally, such as `\a` or `\x`. When the affected uutils `env` parses the argument, it treats the sequence as invalid, prints an error, exits with status 125, and never starts the intended target program. The result is a denial of service against the dependent workflow, such as a failed service startup, automation step, cron job, CI task, or operational script.

How to fix it

Upgrade uutils coreutils to a version containing the corrected `env -S` parsing behavior when an upstream or distribution-fixed release is available. No fixed version was provided in the advisory input, so track the uutils coreutils project and operating-system or package-maintainer advisories for the exact patched release. Where immediate upgrade is not possible, mitigate by avoiding affected `env -S` patterns in scripts, rewriting commands to avoid problematic single-quoted backslash sequences, using GNU coreutils `env` where compatibility is required, or explicitly invoking an unaffected `env` binary in critical automation. For production automation, prefer testing script compatibility in the same runtime image or operating-system distribution used for execution.

How to confirm the fix worked

Confirm exposure by checking whether `env` comes from uutils coreutils and whether scripts or automation use `env -S`. Run a controlled compatibility test on non-production systems using representative `env -S` commands that include single-quoted backslash sequences such as `\a` or `\x`; affected versions will return an `invalid sequence` error and exit status 125 instead of launching the target command. After remediation, repeat the same tests and verify GNU-compatible behavior, successful command execution, and absence of exit status 125. Also scan script repositories, container images, package hooks, cron entries, CI definitions, and service unit files for `env -S` usage to identify workflows that may be impacted.

Typical attack path

1. Identify a host, container image, appliance, or workflow using uutils coreutils instead of GNU coreutils.
2. Find a script or automation path that invokes `env -S` and whose arguments can be influenced directly or indirectly.
3. Introduce a single-quoted split-string containing a backslash sequence accepted by GNU semantics but rejected by affected uutils behavior, such as `\a` or `\x`.
4. Trigger execution of the affected script or workflow.
5. uutils `env` fails argument parsing, emits an `invalid sequence` error, exits with status 125, and prevents the intended command from running.
6. Dependent automation, service startup, or administrative processing fails, producing a local availability impact.

How to detect it

This issue does not create a strong compromise artifact because it is a local availability bug rather than a code-execution vulnerability. To determine whether it was triggered, review logs from automation systems, cron, systemd services, CI/CD runners, package-install hooks, deployment tools, and administrative scripts for failed `env -S` invocations, messages containing `invalid sequence`, and process exit status 125. Shell history, auditd process-execution logs, EDR command-line telemetry, and container runtime logs can help identify whether a local user or automated process executed `env -S` with single-quoted backslash sequences such as `\a` or `\x`. Correlate failures with user sessions, recent script changes, package updates, deployment events, or suspicious local account activity. Because there are no public threat actors or KEV activity associated with this issue, prioritize evidence of repeated intentional triggering, unusual local users modifying scripts, or failures in security- or operations-critical jobs.

• env -S
• --split-string
• invalid sequence
• exit status 125
• exited with status 125
• env: invalid sequence
• \a
• \x

What your security team should do

• Inventory systems, containers, and build images that use uutils coreutils, especially where `env` is provided by uutils rather than GNU coreutils.
• Prioritize remediation for environments where failed automation could affect service startup, deployment, backup, monitoring, or administrative operations.
• Search code repositories and runtime images for `env -S` usage and test those scripts against the actual deployed `env` implementation.
• Replace affected syntax or temporarily use GNU coreutils `env` for critical workflows until a fixed uutils release is deployed.
• Monitor package-manager, distribution, and upstream uutils coreutils advisories for the fixed version because no fixed version was provided in the current advisory data.
• Treat observed failures as operational reliability incidents unless paired with suspicious local activity, because the flaw does not by itself indicate compromise or remote exploitation.