Command Injection in RPM via rpmbuild -t

Executive Summary

CVE-2026-84837 is a command injection vulnerability in the RPM package manager's rpmbuild -t* command. It occurs when rpmbuild processes a tarball with a path or filename containing shell metacharacters, allowing an attacker to inject arbitrary shell commands. This can lead to unintended command execution with the privileges of the user running rpmbuild.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for systems running rpmbuild -t* with untrusted tarballs. Look for filenames containing shell metacharacters like semicolons, backticks, or pipes. Inspect build logs for unexpected commands executed during rpmbuild operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on your system with the privileges of the build user. This could lead to information disclosure, system compromise, or disruption of the build environment. Exploitation requires the attacker to influence the tarball path or filename in a build or CI workflow.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling arbitrary command execution in build environments. If exploited, it may lead to unauthorized access, data exfiltration, or system disruption, which could violate confidentiality or integrity requirements under these regulations. However, the actual compliance impact depends on the specific environment and whether the vulnerability is exploited in a system handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

• Avoid using rpmbuild -t* on tarballs with untrusted filenames or paths.
• Stage tarballs in a trusted directory and normalize filenames to remove shell metacharacters before processing.
• Update rpm to a patched version if available, ensuring shell-escaping of paths in getTarSpec.

Useful 0 Not Useful 0