Is CVE-2026-12545 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12545 being exploited in the wild.

How severe is CVE-2026-12545?

Medium severity, with a CVSS score of 6.7, published 1 October 2026.

Is there a fix for CVE-2026-12545?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12545 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-12545?

Check whether you run Ruby Hammer Cli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12545: rubygem-hammer_cli command injection via insecure editor invocation

CVE-2026-12545 · Severity: medium · CVSS 6.7 · Published 2026-10-01

Hammer CLI is a command-line interface tool for managing Red Hat Satellite, a system management platform used by enterprises. A flaw in how Hammer CLI invokes the user's text editor allows an attacker to execute arbitrary shell commands by manipulating the $EDITOR environment variable, potentially leading to unauthorized access or control of systems managed through Satellite.

Vendors: Ruby.

Quick answers

Is CVE-2026-12545 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12545 being exploited in the wild.
How severe is CVE-2026-12545?: Medium severity, with a CVSS score of 6.7, published 1 October 2026.
Which products and versions are affected?: Ruby Hammer Cli <UNKNOWN>.
Is there a fix for CVE-2026-12545?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12545 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-12545?: Check whether you run Ruby Hammer Cli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command injection flaw in rubygem-hammer_cli caused by insecure interpolation of the $EDITOR environment variable into the Ruby system() method. When a single interpolated string is passed to system(), the shell (/bin/sh) interprets metacharacters (;, |, &) allowing command injection. An attacker who can control the $EDITOR environment variable on a system where Hammer CLI is used can achieve arbitrary command execution with the privileges of the CLI user.

Affected products

Ruby hammer_cli <UNKNOWN>

Timeline

2026-10-01: disclosed
2026-10-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.