Executive brief
RPM is a package management system used to build and install software packages on Linux systems. A vulnerability in the rpmbuild tool allows attackers to inject arbitrary shell commands by crafting malicious tarball filenames or paths. In automated build environments or CI/CD pipelines, this could let an attacker execute code with the privileges of the build user, potentially stealing secrets, modifying build artifacts, or disrupting the build process.
Technical details
A command injection vulnerability (CWE-78) exists in the `rpmbuild -t*` command when processing tarballs with attacker-controlled paths or filenames. The vulnerable `getTarSpec` function fails to properly escape shell metacharacters in tarball names before passing them to shell commands. Attack requires local access and user interaction (an attacker must influence the tarball path/name in a build workflow), but no elevated privileges are needed. Successful exploitation results in arbitrary command execution with the privileges of the user running rpmbuild. Red Hat rates this as Moderate severity because it requires local build/CI context and is not network-exposed; the CVSS v3 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Affected products
- Red Hat RPM affected versions not specified in advisory
Timeline
- 2026-09-02: disclosed: CVE-2026-84837 published