A build-script flaw rated CVSS 9.9 in the uucore crate of uutils coreutils allowed a crafted translation file to inject arbitrary Rust code into a build. A researcher published details and a proof-of-concept, and the maintainers fixed the issue in uucore 0.12.0.
How an Unescaped Translation String Became Executable Rust
The researcher, JoeCyberTech, described the mechanism. The uucore build script pasted Fluent translation text into a Rust raw string without escaping it. A translation containing the two characters "# closes the raw string early, and the rest of the text compiles as code instead of data.
uutils coreutils is a Rust rewrite of the GNU coreutils collection, and uucore is its shared library crate. Anything injected through the build script runs during compilation and ends up in the resulting binaries.
Build Script Checked for a Quote but Not the Terminator
The build script only checked for a double quote character. It never tested for the actual raw-string terminator. Of the 214 translation files in the project, 34 already contained quotes, and the project’s linter had its quote check turned off. The combination meant neither the build script nor the linter would catch a malicious translation.
Why a Single Merged Pull Request Mattered
The researcher’s assessment is that one merged pull request could plant a backdoor in trusted system binaries. Translation files are the kind of contribution that reviewers often accept with limited scrutiny, since they are text rather than logic, and the flaw turned that text into a code path.
No malicious translation has been found in the wild, according to the disclosure. The risk described is therefore a demonstrated route into the build, not an observed compromise.
Default Coreutils in Mainstream Linux Distributions
uutils reportedly ships as the default coreutils in mainstream Linux distributions, putting its binaries among the most basic tools on those systems. The uucore crate has more than 2.5 million downloads on crates.io. A backdoor placed through the build would inherit the trust that system utilities carry, because administrators and scripts run them routinely and often with elevated privileges.
Fix Shipped in uucore 0.12.0 for the Build Script Flaw
The fix is in uucore 0.12.0. The disclosed remedy is to upgrade to that version or later. Details and the proof-of-concept were published on November 9, the same day as the fix reference.
The case belongs to a broader category of supply-chain risks that sit in build tooling rather than shipped code. Attacks of this kind have drawn attention since the SolarWinds compromise in 2020 because they alter software before it reaches users, and because standard code review of the source may not examine the scripts and data files that feed the compiler. In this instance the entry point was not a dependency or a maintainer account but a localization file, a category of contribution that projects rarely treat as sensitive.
The disclosure does not say how long the vulnerable build script was in place or whether any released builds contained injected code beyond the researcher’s demonstration.
Scale of the Rust Coreutils Rewrite and Its Download Footprint
uutils coreutils is a Rust rewrite of the GNU coreutils set of command-line utilities, and its shared uucore crate has drawn more than 2.5 million downloads from crates.io. The figures give a sense of how many builds pull in the vulnerable build script.
The researcher’s account points to review gaps as much as to the code flaw. A linter check on quotes existed but was turned off, and 34 of the 214 translation files already contained quotes, so the one safeguard that might have flagged suspicious text was not running. A reviewer examining a translation pull request would have seen readable text, not code, which is why a single merged change was enough to carry the risk.
The disclosed score of CVSS 9.9 reflects the severity of build-time code injection into system utilities rather than any observed attack. The researcher found no malicious translation in the wild.
