{"metadata": {"vulnerability": "CVE-2026-35339", "count": 18, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-04-02T12:58:56.086Z", "date_only": false, "value": "2026-04-02T12:58:56.086Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-35339", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-22T16:07:33.703Z", "date_only": false, "value": "2026-04-22T16:07:33.703Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35339", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-04-22T16:07:33.703Z", "date_only": false, "value": "2026-04-22T16:07:33.703Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / canonical", "record": "CVE-2026-35339", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-22T17:16:00Z", "date_only": false, "value": "2026-04-22T17:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-35339", "record": "UBUNTU-CVE-2026-35339", "field": "published"}, {"timestamp": "2026-04-22T17:16:35Z", "date_only": false, "value": "2026-04-22T17:16:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VP6Q-MV9J-J428", "record": "GHSA-VP6Q-MV9J-J428", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-22T17:16:35.767Z", "date_only": false, "value": "2026-04-22T17:16:35.767", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35339", "record": "FKIE_CVE-2026-35339", "field": "published"}, {"timestamp": "2026-04-22T18:13:28.800Z", "date_only": false, "value": "2026-04-22T18:13:28.800322Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35339", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-22T18:13:28.800Z", "date_only": false, "value": "2026-04-22T18:13:28.800322Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35339", "record": "FKIE_CVE-2026-35339", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-22T18:13:40.854Z", "date_only": false, "value": "2026-04-22T18:13:40.854Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-35339", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-22T18:13:40.854Z", "date_only": false, "value": "2026-04-22T18:13:40.854Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35339", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-22T18:31:44Z", "date_only": false, "value": "2026-04-22T18:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VP6Q-MV9J-J428", "record": "GHSA-VP6Q-MV9J-J428", "field": "published"}, {"timestamp": "2026-05-14T11:40:57Z", "date_only": false, "value": "2026-05-14T11:40:57Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-35339", "record": "UBUNTU-CVE-2026-35339", "field": "modified"}, {"timestamp": "2026-06-17T10:40:25.290Z", "date_only": false, "value": "2026-06-17T10:40:25.290", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35339", "record": "FKIE_CVE-2026-35339", "field": "lastModified"}, {"timestamp": "2026-07-06T19:27:28Z", "date_only": false, "value": "2026-07-06T19:27:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VP6Q-MV9J-J428", "record": "GHSA-VP6Q-MV9J-J428", "field": "modified"}, {"timestamp": "2026-07-06T19:27:28Z", "date_only": false, "value": "2026-07-06T19:27:28Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-VP6Q-MV9J-J428", "record": "GHSA-VP6Q-MV9J-J428", "field": "withdrawn"}, {"timestamp": "2026-07-06T19:27:41Z", "date_only": false, "value": "2026-07-06T19:27:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4X34-CHG5-MWJJ", "record": "GHSA-4X34-CHG5-MWJJ", "field": "published"}, {"timestamp": "2026-07-06T19:27:41Z", "date_only": false, "value": "2026-07-06T19:27:41Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4X34-CHG5-MWJJ", "record": "GHSA-4X34-CHG5-MWJJ", "field": "modified"}, {"timestamp": "2026-07-06T19:41:46.111Z", "date_only": false, "value": "2026-07-06T19:41:46.111341Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/194b323308c6542ff0a22bb475e2c02f", "record": "CVE-2026-35339", "field": "creation_timestamp", "uuid": "efccf5d6-9354-4695-9b6a-dd3d3061ee49", "content": "# CVE-2026-35339: CVE-2026-35339: Incorrect Exit Status Propagation in Rust uutils/coreutils chmod Recursive Execution\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-35339\n\n## Summary\nCVE-2026-35339 is a logic vulnerability in the Rust-written `uutils/coreutils` implementation of the `chmod` utility. When executing recursively (`-R` or `--recursive`) over multiple target paths, the utility fails to accumulate the overall exit status, overwriting error codes from early failures with the status of the final target. This results in false-success exit codes (0), potentially leading security automation and deployment scripts to assume permission modifications succeeded when they actually failed.\n\n## TL;DR\nA 'last-file-wins' logic vulnerability in Rust-based `chmod -R` permits silent failures, returning exit code 0 even if previous targets failed. This bypasses automated permission checks in scripts and CI/CD pipelines.\n\n## Technical Details\n\n- **CWE ID**: CWE-253 (Incorrect Check of Function Return Value)\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1**: 5.5 (Medium)\n- **EPSS Score**: 0.00142 (3.90th percentile)\n- **Impact**: Integrity Loss (Silent permission-application bypasses)\n- **Exploit Status**: No public weaponized exploits available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- uutils/coreutils\n- **coreutils**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade uutils/coreutils to version 0.6.0 or later.\n- Deconstruct multi-argument recursive chmod operations in scripts into separate commands or chain them with explicit logical operators.\n- Implement defensive post-execution verification checks using test operators or find to validate that target permissions match expectations.\n\n**Remediation Steps:**\n1. Identify systems or container images using Rust uutils/coreutils.\n2. Update coreutils package to version 0.6.0 or higher.\n3. For active CI/CD pipelines, audit bash scripts or Ansible playbooks that invoke chmod with multiple recursive directory targets.\n4. Modify multi-target invocations to single-target invocations linked with '&&' if immediate upgrades are not possible.\n\n## References\n\n- [CVE-2026-35339 Record](https://www.cve.org/CVERecord?id=CVE-2026-35339)\n- [GitHub Pull Request 9793](https://github.com/uutils/coreutils/pull/9793)\n- [Security Fix Commit](https://github.com/uutils/coreutils/commit/abd581f62e97d0b147306ac40eac13af71c6fbba)\n- [uutils coreutils 0.6.0 Release](https://github.com/uutils/coreutils/releases/tag/0.6.0)\n- [Wiz Vulnerability Database Entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-35339)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-35339) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/194b323308c6542ff0a22bb475e2c02f"}]}