{"metadata": {"vulnerability": "CVE-2026-35366", "count": 18, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-04-02T12:58:56.088Z", "date_only": false, "value": "2026-04-02T12:58:56.088Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-35366", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-22T16:08:43.746Z", "date_only": false, "value": "2026-04-22T16:08:43.746Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35366", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-04-22T16:08:43.746Z", "date_only": false, "value": "2026-04-22T16:08:43.746Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / canonical", "record": "CVE-2026-35366", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-22T17:16:00Z", "date_only": false, "value": "2026-04-22T17:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-35366", "record": "UBUNTU-CVE-2026-35366", "field": "published"}, {"timestamp": "2026-04-22T17:16:40Z", "date_only": false, "value": "2026-04-22T17:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7259-CWHX-3XX3", "record": "GHSA-7259-CWHX-3XX3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-22T17:16:40.167Z", "date_only": false, "value": "2026-04-22T17:16:40.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35366", "record": "FKIE_CVE-2026-35366", "field": "published"}, {"timestamp": "2026-04-22T17:50:05.095Z", "date_only": false, "value": "2026-04-22T17:50:05.095688Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35366", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-22T17:50:05.095Z", "date_only": false, "value": "2026-04-22T17:50:05.095688Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35366", "record": "FKIE_CVE-2026-35366", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-22T17:50:09.879Z", "date_only": false, "value": "2026-04-22T17:50:09.879Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-35366", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-22T17:50:09.879Z", "date_only": false, "value": "2026-04-22T17:50:09.879Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35366", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-22T18:31:45Z", "date_only": false, "value": "2026-04-22T18:31:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7259-CWHX-3XX3", "record": "GHSA-7259-CWHX-3XX3", "field": "published"}, {"timestamp": "2026-05-14T11:40:57Z", "date_only": false, "value": "2026-05-14T11:40:57Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-35366", "record": "UBUNTU-CVE-2026-35366", "field": "modified"}, {"timestamp": "2026-06-17T10:40:28.190Z", "date_only": false, "value": "2026-06-17T10:40:28.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35366", "record": "FKIE_CVE-2026-35366", "field": "lastModified"}, {"timestamp": "2026-07-06T20:25:37Z", "date_only": false, "value": "2026-07-06T20:25:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7259-CWHX-3XX3", "record": "GHSA-7259-CWHX-3XX3", "field": "modified"}, {"timestamp": "2026-07-06T20:25:37Z", "date_only": false, "value": "2026-07-06T20:25:37Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-7259-CWHX-3XX3", "record": "GHSA-7259-CWHX-3XX3", "field": "withdrawn"}, {"timestamp": "2026-07-06T20:25:42Z", "date_only": false, "value": "2026-07-06T20:25:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P7H3-7Q52-72W8", "record": "GHSA-P7H3-7Q52-72W8", "field": "published"}, {"timestamp": "2026-07-06T20:25:42Z", "date_only": false, "value": "2026-07-06T20:25:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P7H3-7Q52-72W8", "record": "GHSA-P7H3-7Q52-72W8", "field": "modified"}, {"timestamp": "2026-07-06T21:12:12.324Z", "date_only": false, "value": "2026-07-06T21:12:12.324972Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/07d450ac5289edebf7f986d4d73c3cf2", "record": "CVE-2026-35366", "field": "creation_timestamp", "uuid": "b58a3fec-fe89-4cac-8933-1e635175299e", "content": "# CVE-2026-35366: CVE-2026-35366: Security Inspection Bypass in uutils coreutils printenv via non-UTF-8 Environment Variables\n\n> **CVSS Score:** 4.4\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-35366\n\n## Summary\nA security inspection bypass vulnerability exists in the printenv utility of uutils coreutils (a Rust-based implementation of GNU coreutils) prior to version 0.6.0. Due to a semantic mismatch between POSIX environment variable specifications and Rust's strict UTF-8 validation rules, environment variables containing invalid UTF-8 byte sequences are silently omitted from printenv outputs. This allows local attackers to load and execute adversarial environment variables while remaining undetected by system administrators and automated security auditing tools.\n\n## TL;DR\nPrior to version 0.6.0, the Rust implementation of printenv silently filters out environment variables that contain invalid UTF-8 byte sequences, allowing attackers to hide malicious environmental settings from security audits.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-754\n- **Attack Vector**: Local\n- **CVSS v3.1 Score**: 4.4\n- **EPSS Score**: 0.0017 (0.17%)\n- **Impact**: Defense Evasion / Inspection Bypass\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- POSIX-compliant systems using uutils coreutils printenv prior to version 0.6.0\n- Security auditing tools relying on uutils coreutils printenv outputs\n- **coreutils**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade uutils coreutils to version 0.6.0 or later.\n- Audit active process environment blocks using kernel-level interfaces like /proc instead of vulnerable utilities.\n- Avoid using standard Rust String types for handling operating system environment interfaces in system utilities.\n\n**Remediation Steps:**\n1. Locate systems running uutils coreutils.\n2. Update the package to version 0.6.0 or later using the appropriate system package manager or Cargo.\n3. For temporary auditing, use 'cat /proc//environ | tr \"\\0\" \"\\n\"' to securely examine environments in a raw byte format.\n\n## References\n\n- [uutils coreutils Issue #9701: printenv skips environment variables with invalid UTF-8](https://github.com/uutils/coreutils/issues/9701)\n- [uutils coreutils Release 0.6.0](https://github.com/uutils/coreutils/releases/tag/0.6.0)\n- [CVE-2026-35366 Record](https://www.cve.org/CVERecord?id=CVE-2026-35366)\n- [NVD Advisory for CVE-2026-35366](https://nvd.nist.gov/vuln/detail/CVE-2026-35366)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-35366) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/07d450ac5289edebf7f986d4d73c3cf2"}]}