A vulnerability in uutils coreutils chroot utility allows privilege escalation when using --userspec option. The flaw occurs because getpwnam() is called after entering chroot but before dropping root privileges. On glibc systems, this triggers Name Service Switch to load shared libraries from the new root directory. Attackers with write access to NEWROOT can inject malicious NSS modules to execute arbitrary code as root. This enables full container escape or privilege escalation attacks.