Executive brief
RPM is a package manager widely used in Linux distributions to install and manage software. A local attacker can exploit a flaw in the rpmuncompress utility by providing a specially crafted .gem (Ruby gem) filename that contains shell commands hidden in RPM macro syntax. When a user or automated build workflow extracts this file, the embedded commands execute with the user's privileges, potentially compromising system confidentiality, integrity, and availability.
Technical details
This vulnerability is an OS command injection (CWE-78) affecting RPM's rpmuncompress utility. The root cause is insufficient sanitization of filenames during macro expansion; when rpmuncompress -x processes a .gem file with a specially crafted name containing RPM macro syntax (e.g., `%(...)` expansion), the macros are evaluated during command construction before the filename is safely passed to the extraction tool. Attack requires local file access and user interaction (someone or an automated workflow must invoke rpmuncompress on the attacker-supplied .gem file). Successful exploitation allows arbitrary command execution with the privileges of the invoking account. The vulnerability is not remotely exploitable without user involvement, and Red Hat rates it Moderate severity despite the high CVSS base score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Affected products
- Red Hat rpm
Timeline
- 2026-09-01: disclosed
- other: Reported not exploited in wild