[GHSA-pmfc-4wjj-gmhx] cut: -s ignored in -z -d '' newline-delimiter mode

[vitoroliveirasilva]

Updates

• Affected products
• References

Comments
The current affected and patched version ranges appear to be incorrect.

Version 0.7.0 was released on March 8, 2026. Although that release included a related fix for cut -s with a newline delimiter in pull request #11143, it did not fix the specific -z -d '' special-case described by this advisory.

The advisory's exact reproduction case was fixed later by pull request #11394, which was merged on March 20, 2026:

uutils/coreutils#11394

That fix is explicitly included in the release notes for version 0.8.0:

https://github.com/uutils/coreutils/releases/tag/0.8.0

Therefore, version 0.7.0 remained affected by this specific issue. The affected range should be < 0.8.0, and the patched version should be 0.8.0.

[github]

Hi there @sylvestre! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory