CVE-2026-95521

Summary

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Affected Software

Weaknesses

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

To mitigate this issue, Red Hat recommends avoiding the installing or rebuilding of source RPMs from untrusted or unverified sources.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://access.redhat.com/security/cve/CVE-2026-95521
• https://bugzilla.redhat.com/show_bug.cgi?id=2537812

• ←Previous
• Next→