{"action":"Upgrade uu_rm to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"uu_rm","cve_ids":["CVE-2026-35349"],"ecosystem":"crates.io","epss":0.00185,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-7cr3-h577-g38j","id":"tcs_01M5KEV7D408M8B7ZFWAEGV9YX","modified_at":"2026-07-06T20:41:03.620763Z","published_at":"2026-07-06T20:15:27Z","references":["https://osv.dev/vulnerability/GHSA-7cr3-h577-g38j","https://github.com/uutils/coreutils/security/advisories/GHSA-7cr3-h577-g38j","https://nvd.nist.gov/vuln/detail/CVE-2026-35349","https://github.com/uutils/coreutils/pull/9706","https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e","https://github.com/uutils/coreutils","https://github.com/uutils/coreutils/releases/tag/0.7.0"],"severity":{"label":"medium","score":6.7},"sources":[{"source":"osv","source_id":"GHSA-7cr3-h577-g38j","url":"https://osv.dev/vulnerability/GHSA-7cr3-h577-g38j"}],"summary":"rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)"}