CVE-2026-35373Low· 3.3▾ Sunlitln: rejects non-UTF-8 source filenames in target-directory mode
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.1%
In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.
PoC:
name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty
Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
uu_ln < 0.6.0Upgrade to a patched release:
uu_ln 0.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35346Low· 3.3comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output
CVE-2026-49401Medium· 5.2Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-116542Medium· 5.3Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
CVE-2026-114114Medium· 5.3Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
CVE-2026-110674NoneCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
CVE-2026-110687NoneCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp