CVE-2026-84837
Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
CVE-2026-84837 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 54th percentile. Fixed in rpm 4.11.3-48.0.3.el7_9.tuxcare.els3.
- Severity
- 7.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.71%EPSS, 54th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.11.3-48.0.3.el7_9.tuxcare.els3rpm +199 more
Description
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpmTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-apidocsTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-buildTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-build-libsTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-cronTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-develTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-libsTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-plugin-systemd-inhibitTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-pythonTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-signTuxCare:OracleLinux:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
Show 190 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rpmTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-apidocsTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-buildTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-build-libsTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-cronTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-develTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-libsTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-plugin-systemd-inhibitTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-pythonTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpm-signTuxCare:RHEL:7 | before 4.11.3-48.0.3.el7_9.tuxcare.els3 | 4.11.3-48.0.3.el7_9.tuxcare.els3 |
rpmDebian:12 | All versions, plus listed versions 4.18.0+dfsg-14.18.0+dfsg-1+deb12u14.18.2+dfsg-14.18.2+dfsg-1.1~exp14.18.2+dfsg-2 Show 15 moreShow less4.18.2+dfsg-2.14.18.2+dfsg-2.1~exp14.19.1.1+dfsg-14.19.1.1+dfsg-1~exp4.20.0+dfsg-14.20.0+dfsg-24.20.0+dfsg-34.20.0+dfsg-44.20.1+dfsg-14.20.1+dfsg-24.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 | None known |
rpmDebian:13 | All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 | None known |
rpmDebian:14 | All versions, plus listed versions 4.20.1+dfsg-36.0.0-16.0.0-26.0.1-16.1.0-1 | None known |
rpmopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs | before 4.18.2-42.oe2403sp1 | 4.18.2-42.oe2403sp1 |
rpmopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs | before 4.18.2-42.oe2403sp3 | 4.18.2-42.oe2403sp3 |
rpmopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs | before 4.18.2-42.oe2403sp4 | 4.18.2-42.oe2403sp4 |
python3-rpmRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpmRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-apidocsRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-buildRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-build-libsRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-cronRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-develRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-libsRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-auditRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-dbus-announceRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-fapolicydRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-fsverityRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-imaRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-prioresetRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-selinuxRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-syslogRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-systemd-inhibitRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-plugin-unshareRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-signRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
rpm-sign-libsRed Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:6.1.0-1.3.hum1 | 0:6.1.0-1.3.hum1 |
python3-rpm-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-apidocsRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-buildRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-cronRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-develRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-audit-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-fapolicydRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-fapolicyd-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-imaRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-ima-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-prioreset-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-selinux-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-syslogRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-syslog-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-systemd-inhibitRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-systemd-inhibit-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
python3-rpmRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
python3-rpm-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpmRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-libsRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-libs-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-devel-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-libsRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-libs-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-auditRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-audit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-fapolicyd-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-ima-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-prioreset-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-selinuxRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-selinux-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-syslog-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-systemd-inhibit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-signRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libsRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libs-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
python3-rpm-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-apidocsRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-buildRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-libs-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-cronRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-debugsourceRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-develRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-devel-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-libs-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-audit-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-dbus-announceRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-dbus-announce-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-fapolicydRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-fapolicyd-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-imaRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-ima-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-prioreset-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-selinux-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-syslog-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-systemd-inhibitRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-systemd-inhibit-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-sign-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-sign-libs-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
python3-rpmRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpmRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-libsRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-libsRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-auditRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-selinuxRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-syslogRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-signRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-sign-libsRed Hat:enterprise_linux:10.3 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
python3-rpmRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
python3-rpm-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpmRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-buildRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-libsRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-build-libs-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-debugsourceRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-develRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-devel-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-libsRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-libs-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-auditRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-audit-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-fapolicydRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-fapolicyd-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-imaRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-ima-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-selinuxRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-selinux-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-syslogRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-syslog-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-systemd-inhibitRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-plugin-systemd-inhibit-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-signRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libsRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libs-debuginfoRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-apidocsRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-cronRocky Linux:9 From an advisory covering 2 CVEs | before 0:4.16.1.3-43.el9_9 | 0:4.16.1.3-43.el9_9 |
rpm-sign-libsRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-selinuxRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-fapolicydRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-ima-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-libsRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-buildRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-dbus-announce-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-selinux-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-dbus-announceRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-audit-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
python3-rpmRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
python3-rpm-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-signRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-libs-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-syslogRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-debugsourceRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-imaRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-sign-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-devel-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-develRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-systemd-inhibitRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-sign-libs-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-syslog-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-libs-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpmRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-build-libsRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-auditRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-fapolicyd-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-plugin-systemd-inhibit-debuginfoRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-cronRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpm-apidocsRocky Linux:10 From an advisory covering 4 CVEs | before 0:4.19.1.1-29.el10_3 | 0:4.19.1.1-29.el10_3 |
rpmUbuntu:Pro:14.04:LTS | All versions, plus listed versions 4.11.1-24.11.1-34.11.1-3ubuntu0.14.11.1-3ubuntu0.1+esm1 | None known |
rpmUbuntu:Pro:16.04:LTS | All versions, plus listed versions 4.12.0.1+dfsg1-3build24.12.0.1+dfsg1-3build34.12.0.1+dfsg1-3ubuntu0.1~esm1 | None known |
rpmUbuntu:Pro:18.04:LTS | All versions, plus listed versions 4.12.0.2+dfsg1-2build24.14.0+dfsg1-24.14.1+dfsg1-24.14.1+dfsg1-2ubuntu0.1~esm1 | None known |
rpmUbuntu:Pro:20.04:LTS | All versions, plus listed versions 4.14.2.1+dfsg1-14.14.2.1+dfsg1-1build14.14.2.1+dfsg1-1build24.14.2.1+dfsg1-1ubuntu0.1~esm1 | None known |
rpmUbuntu:22.04:LTS | All versions, plus listed versions 4.16.1.2+dfsg1-3ubuntu14.16.1.2+dfsg1-3ubuntu34.17.0+dfsg1-14.17.0+dfsg1-34.17.0+dfsg1-44.17.0+dfsg1-4build1 | None known |
rpmUbuntu:24.04:LTS | All versions, plus listed versions 4.18.0+dfsg-1build14.18.0+dfsg-1build24.18.2+dfsg-14.18.2+dfsg-24.18.2+dfsg-2.1build14.18.2+dfsg-2.1build2 | None known |
rpmUbuntu:26.10 | All versions, plus listed versions 6.0.1-1build16.1.0-1 | None known |
rpmUbuntu:26.04:LTS | All versions, plus listed versions 4.20.1+dfsg-36.0.0-26.0.1-16.0.1-1build1 | None known |
What each source reports
CVE List Score used
Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
CVE-2026-84837- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-12
EUVDEUVD-2026-70108
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
EUVD-2026-70108- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-7m7j-6vw6-f549
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing...
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
GHSA-7m7j-6vw6-f549- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-12
NVD
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
CVE-2026-84837- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-84837
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
DEBIAN-CVE-2026-84837- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVOESA-2026-4510
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.(CVE-2026-84837)
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.(CVE-2026-84838)
- Record
OESA-2026-4510- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2026-4511
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.(CVE-2026-84837)
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.(CVE-2026-84838)
- Record
OESA-2026-4511- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4512
rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below
Security Fix(es):
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.(CVE-2026-84837)
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.(CVE-2026-84838)
- Record
OESA-2026-4512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:82378
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:82378- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99593
Red Hat Security Advisory: rpm security update
- Record
RHSA-2026:99593- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99595
Red Hat Security Advisory: rpm security update
- Record
RHSA-2026:99595- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:99593
Moderate: rpm security update
The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.
Security Fix(es):
rpm: Command Injection in
rpmbuild -t*(getTarSpec) via Unescaped Tarball Path (CVE-2026-84837)rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:99593- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:99595
Moderate: rpm security update
The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.
Security Fix(es):
rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)
rpm: Command Injection in
rpmbuild -t*(getTarSpec) via Unescaped Tarball Path (CVE-2026-84837)rpm: Command Execution via Macro Expansion in
rpmuncompress -xfor Crafted.gemFilenames (CVE-2026-84233)rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:99595- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-84837
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
- Record
UBUNTU-CVE-2026-84837- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1792769939No score
rpm: Fix of CVE-2026-84837
- CVE-2026-84837: do not macro expand or shell interpret the tarball file name passed to rpmbuild -t
- Record
CLSA-2026-1792769939- Updated
- 2026-11-02
OSVCLSA-2026-1792770120No score
rpm: Fix of CVE-2026-84837
- CVE-2026-84837: do not macro expand or shell interpret the tarball file name passed to rpmbuild -t
- Record
CLSA-2026-1792770120- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| references | CVE List, GitHub Advisories | |
| references | EUVD, NVD | |
| references | CVE List | |
| references | GitHub Advisories, NVD, OSV | |
| affected, products | CVE List, EUVD, NVD | |
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:82378
bugzilla.redhat.com/show_bug.cgi?id=2478408
nvd.nist.gov/vuln/detail/CVE-2026-84837
Show 29 moreShow less
github.com/advisories/GHSA-7m7j-6vw6-f549
errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792769939.html
security-tracker.debian.org/tracker/CVE-2026-84837
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4510
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82378.json
cve.org/CVERecord?id=CVE-2026-78367
errata.rockylinux.org/RLSA-2026:99593
ubuntu.com/security/CVE-2026-84837