The cut utility in the uutils coreutils package incorrectly handles the -s option when a newline character is passed as the delimiter. The implementation does not check the only_delimited flag inside the cut_fields_newline_char_delim function, resulting in non-delimited lines being printed to output. This allows data that should be suppressed to flow to downstream processes, potentially exposing sensitive information that is not intended to be publicly visible.

The affected product is the cut command provided by the uutils coreutils project. No specific version numbers are listed in the advisory, so all releases prior to the fix in the 0.7.0 release are considered vulnerable.

The CVSS score of 3.3 categorizes this issue as low severity. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not part of the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local: an attacker who can run the cut utility with the vulnerable options on the target system or control a script that invokes it can cause unintended data leakage. Because the flaw only affects the output of a command that may be part of automated data processing pipelines, the impact is limited to confidentiality leakage rather than code execution or denial of service.