split accepts non-UTF-8 prefix/suffix inputs but builds chunk filenames with to_string_lossy(), rewriting invalid bytes to the U+FFFD replacement character. GNU keeps pathname bytes intact. Chunk files are created under rewritten names, which can cause filename collisions or misdirected output in non-UTF-8 environments.
PoC:
d=$(mktemp -d); p=$(printf "p\377"); printf "AB" | split -b1 - "$d/$p"; ls "$d" | od -An -tx1
# GNU: 70 ff ... ; uutils: 70 ef bf bd ...
Zellic private finding (zellic-ext/coreutils-private PR #109). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
splitaccepts non-UTF-8 prefix/suffix inputs but builds chunk filenames withto_string_lossy(), rewriting invalid bytes to the U+FFFD replacement character. GNU keeps pathname bytes intact. Chunk files are created under rewritten names, which can cause filename collisions or misdirected output in non-UTF-8 environments.PoC:
Zellic private finding (zellic-ext/coreutils-private PR #109). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit
3a07ffc5a9bd4c283e75afa548ba1f1957bad242.