Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| coreutils | rust | <= 0.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the ln utility of uutils/coreutils, specifically within the link_files_in_dir function. The root cause is the improper handling of non-UTF-8 filenames. The original code attempted to convert filenames to UTF-8 strings using as_os_str().to_str(). On Unix-like systems, filenames are just sequences of bytes and are not guaranteed to be valid UTF-8. When a filename with invalid UTF-8 bytes was passed to ln with a target directory, the to_str() call would fail, returning None. This triggered an error-handling path that would print a "cannot stat" error and prevent the link from being created, resulting in a local denial of service for operations involving such files. The patch, found in commit 83a0f4d56c471e8063e919a9196608acdd7d5879, rectifies this by removing the explicit UTF-8 conversion and instead working directly with OsStr and Path types, which correctly handle byte-oriented filenames. This aligns the behavior of uutils/coreutils with GNU ln, which processes such filenames without issue.
