Expected Behavior Violation Affecting uucore package, versions <0.6.0

uucore is an uutils code library

Affected versions of this package are vulnerable to Expected Behavior Violation due to determine_backup_mode in backup_control.rs. An attacker can cause cp, install, mv, or ln to overwrite a file without creating the expected backup by supplying --suffix without --backup, so scripts or users relying on a suffixed backup lose the original data instead of preserving it.

Notes

• --suffix alone only takes effect in the backup-mode selection path used by the shared uucore helper, so the issue shows up anywhere that code is reused by the four GNU-coreutils-style commands rather than in a single command-specific parser.
• The failure only matters when the destination file is actually being overwritten and a script/user is relying on a suffixed backup name as the preservation step; the data-loss risk is the original file contents being replaced without the expected *.bak copy being left behind.

Workarounds

• Use --backup or -b together with --suffix when you rely on a backup being created before cp, install, mv, or ln overwrites a file; this prevents silent data loss from --suffix being ignored as a backup trigger.

• GitHub Commit
• Maintainer's Advisory