PoC published for uucore build-script FTL translation injection allowing Rust code execution in uutils coreutils (CVSS 9.9)
Researcher JoeCyberTech has published full technical details and a proof-of-concept for a build-time code injection flaw in uucore, the shared crate behind uutils coreutils, the Rust rewrite of the GNU core utilities (ls, cp, cat). The build script inserted Fluent translation text (.ftl files) into a Rust raw string without proper escaping, so a translation containing the byte pair "# closed the raw string and let everything after it be compiled as Rust code. The researcher rates the issue CVSS 9.9 and the GitHub advisory, as reported by securityonline.info, lists uucore 0.2.2 through 0.11.0 as affected; the fix shipped in uucore 0.12.0 on 17 September 2026. Exploitation requires a malicious translation file to be merged or vendored into a source tree that is then built, which limits opportunistic abuse but makes it a credible supply-chain vector given uutils ships as the default coreutils in some mainstream Linux distributions and uucore has over 2.5 million downloads on crates.io. No malicious translation has been found in the wild. Searches of public advisory databases during this review did not surface a CVE or RUSTSEC identifier for this specific build-script flaw, and no uutils project statement beyond the referenced GitHub advisory was located.
Entenda a falha
A vulnerabilidade
A build-time code injection flaw in uucore, the shared crate behind uutils coreutils (the Rust rewrite of ls, cp, cat and the other core utilities). The build script put Fluent translation (.ftl) text into a Rust raw string without proper escaping, so a crafted translation could make rustc compile attacker-written Rust code. The attacker needs a malicious translation file merged or vendored into a source tree that is then built; no network access or authentication on the victim is involved. The result is code execution at build time and potentially a backdoor in the resulting system binaries. Affected: uucore 0.2.2 through 0.11.0 (per the GitHub advisory). Fixed in uucore 0.12.0, released 17 September 2026. No CVE was assigned; the researcher rates it CVSS 9.9.
Como funciona
During a build, the uucore build script reads each .ftl translation file and writes its messages into generated Rust source, wrapping each string in a raw string literal that starts with r#". A Rust raw string of that form ends at the first occurrence of the two characters "#. The script only checked whether the translation contained a double quote, not that full terminator. So a message containing "# closes the literal early, and everything after it is no longer treated as text but is parsed by rustc as ordinary source code and compiled into the binary.
Por que é vulnerável
Insufficient escaping and validation of untrusted input when generating code: the build script assumed that checking for a double quote was enough to keep text inside the raw string, and never checked for the "# terminator. It went unnoticed because translation files are treated by reviewers as harmless text; the researcher notes that 34 of 214 translation files already contained quotes and that the project's linter had its quote check disabled. The fix passes the string through Rust's Debug formatter, which escapes every quote, so the injected content becomes inert data.
Onde está
The uucore build script that embeds the .ftl Fluent translation files into generated Rust source; the articles do not name the exact file, function, pull request or commit of the fix.
Como foi descoberta
The researcher JoeCyberTech published the full technical details and a proof-of-concept, and the issue is described in a GitHub advisory that lists the affected versions. The articles do not say how or when it was first found or reported to the maintainers. They report that the maintainers fixed it in uucore 0.12.0 on 17 September 2026, and that no malicious translation has been found in the wild. No CVE or RUSTSEC identifier was located.
PoC pública
JoeCyberTech published a proof-of-concept that appends a shell command to an otherwise harmless-looking translation message, demonstrating that the injected text is compiled as Rust code at build time. It requires a malicious .ftl file to enter a source tree that is then built. Since the fix has been out since September and the technique is now public, anyone building from an affected tree should upgrade to 0.12.0 and audit vendored .ftl files, even though no in-the-wild abuse has been seen.
Publicada em: securityonline.info/uutils-coreutils-vulnerability-poc/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 23:16.
Detalhes técnicos
A Rust raw string opened with r#" terminates at the first occurrence of "#. The uucore build script only checked whether a translation string contained a double quote, never the full terminator sequence, so an early "# in an .ftl file ended the literal and the remainder was parsed by rustc as source code. The published proof-of-concept appends a shell command to an otherwise harmless-looking message. The researcher notes that 34 of the project's 214 translation files already contained quotes and that the project's linter had its quote check disabled, meaning a single merged pull request touching only "text" could have planted a backdoor in trusted system binaries.
Detalhes da correção
The fix routes the translation string through Rust's Debug formatter, which escapes every quote so the injected payload becomes inert data. It is carried by uucore 0.12.0, released 17 September 2026. The specific pull request or commit implementing the change could not be identified from the sources consulted.
Remediação
- Upgrade uutils coreutils and uucore to 0.12.0 or later.
- Rebuild any packages from a fixed source tree; binaries built from an affected tree should be considered suspect.
- Audit vendored
.ftltranslation files for the"#character pair and re-enable linter quote checks on translation contributions.
Linha do tempo
-
PoC published for uucore build-script FTL translation injection allowing Rust code execution in uutils coreutils (CVSS 9.9)
ler a análise desta fonte ocultar
Researcher JoeCyberTech has published full technical details and a proof-of-concept for a build-time code injection flaw in uucore, the shared crate behind uutils coreutils, the Rust rewrite of the GNU core utilities (ls, cp, cat). The build script inserted Fluent translation text (
.ftlfiles) into a Rust raw string without proper escaping, so a translation containing the byte pair"#closed the raw string and let everything after it be compiled as Rust code. The researcher rates the issue CVSS 9.9 and the GitHub advisory, as reported by securityonline.info, lists uucore 0.2.2 through 0.11.0 as affected; the fix shipped in uucore 0.12.0 on 17 September 2026. Exploitation requires a malicious translation file to be merged or vendored into a source tree that is then built, which limits opportunistic abuse but makes it a credible supply-chain vector given uutils ships as the default coreutils in some mainstream Linux distributions and uucore has over 2.5 million downloads on crates.io. No malicious translation has been found in the wild. Searches of public advisory databases during this review did not surface a CVE or RUSTSEC identifier for this specific build-script flaw, and no uutils project statement beyond the referenced GitHub advisory was located.Technical Details
A Rust raw string opened with
r#"terminates at the first occurrence of"#. The uucore build script only checked whether a translation string contained a double quote, never the full terminator sequence, so an early"#in an.ftlfile ended the literal and the remainder was parsed by rustc as source code. The published proof-of-concept appends a shell command to an otherwise harmless-looking message. The researcher notes that 34 of the project's 214 translation files already contained quotes and that the project's linter had its quote check disabled, meaning a single merged pull request touching only "text" could have planted a backdoor in trusted system binaries.Fix Details
The fix routes the translation string through Rust's
Debugformatter, which escapes every quote so the injected payload becomes inert data. It is carried by uucore 0.12.0, released 17 September 2026. The specific pull request or commit implementing the change could not be identified from the sources consulted.Remediation
- Upgrade uutils coreutils and uucore to 0.12.0 or later.
- Rebuild any packages from a fixed source tree; binaries built from an affected tree should be considered suspect.
- Audit vendored
.ftltranslation files for the"#character pair and re-enable linter quote checks on translation contributions.