Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| coreutils | rust | < 0.7.0 | 0.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the rm utility of uutils/coreutils and allows bypassing the --preserve-root safeguard. The root cause was an improper check for the root directory. The code only verified if the path was literally / using path.has_root() && path.parent().is_none(). This check was insufficient because it did not account for symbolic links. An attacker could create a symbolic link to the root directory (e.g., ln -s / tmp/rootlink) and then execute rm -rf /tmp/rootlink/. The trailing slash causes rm to treat the argument as a directory to be traversed. The vulnerable version of the handle_dir function would not detect that /tmp/rootlink/ is effectively the root directory, leading to the recursive deletion of the entire filesystem.
The patch addresses this by introducing a new function, is_root_path, which uses path.canonicalize() to resolve the real path, including any symlinks. This ensures that the path is compared to the actual root directory's identity (device and inode numbers) rather than just its string representation. The vulnerable function handle_dir was updated to use this new, more secure check. Additionally, an upfront check was added to the remove function to catch paths with trailing slashes that resolve to root early in the process.
