Every CVE Search/ Get API key

CVE-2026-95521

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

7.8 High

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.58%Unchanged since Sep 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
CVE-2026-95521
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-06
EUVDEUVD-2026-85878 7.8

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
EUVD-2026-85878
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-7prr-g333-3h48 7.8

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or...

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
GHSA-7prr-g333-3h48
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 7.8

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
CVE-2026-95521
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-06
OSVDEBIAN-CVE-2026-95521 7.8

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
DEBIAN-CVE-2026-95521
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVUBUNTU-CVE-2026-95521 7.8

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
UBUNTU-CVE-2026-95521
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-105326 No score

CVE-2026-95521 affecting package rpm 4.18.2-2

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Record
AZL-105326
Updated
2026-11-05
OSVCLSA-2026-1792688613 No score

rpm: Fix of 3 CVEs

  • CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
  • CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
  • CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
Record
CLSA-2026-1792688613
Updated
2026-11-02
OSVCLSA-2026-1792689108 No score

rpm: Fix of 3 CVEs

  • CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them
  • CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM
  • CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as one taken from a tarball by rpmbuild -t
Record
CLSA-2026-1792689108
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
Azure Linux:3
 through 4.18.2-2 None known
rpm
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-apidocs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build-libs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-cron
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-devel
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-libs
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-plugin-systemd-inhibit
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-python
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
Show 22 moreShow less
Affected packages
PackageAffectedFixed
rpm-sign
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-apidocs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-build-libs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-cron
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-devel
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-libs
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-plugin-systemd-inhibit
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-python
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm-sign
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 4.11.3-48.0.3.el7_9.tuxcare.els2
4.11.3-48.0.3.el7_9.tuxcare.els2
rpm
Debian:12
 All versions, plus listed versions
4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2
Show 15 moreShow less
4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
Debian:13
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
Debian:14
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1
 None known
rpm
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1
 None known
rpm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1
 None known
rpm
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1
 None known
rpm
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1
 None known
rpm
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1
 None known
rpm
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2
 None known
rpm
Ubuntu:26.10
 All versions, plus listed versions
6.0.1-1build16.1.0-1
 None known
rpm
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1
 None known

History

History
RecordedChangedSources
affected, facts, productsCVE List, EUVD, NVD
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-95521 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. No source names a fixed version.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open