CVE-2026-95521
Received Received - Intake

Command Injection in RPM via Spec File Macro

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-95521
EUVD
EUVD-2026-85878

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
red_hat rpm 6.1.0
red_hat rpm From 6.1.0 (inc)
redhat rpm *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95521 is a command injection flaw in the RPM package manager. It occurs when installing or rebuilding a source RPM file where the source or spec file basenames contain a %() macro construct. This causes RPM to execute an attacker-controlled shell command via popen() during the source file relocation process, allowing arbitrary command execution as the invoking user.

Detection Guidance

To detect this vulnerability, inspect .src.rpm files for basenames containing %() macro constructs. Check logs for unexpected command execution during RPM operations. Use rpm -q --changelog <package> to review package metadata for suspicious entries.

Impact Analysis

Exploitation could lead to unauthorized code execution, data access or modification, or denial of service. The attacker needs you to process an untrusted .src.rpm file, but no network service exposure is required. The impact is high on confidentiality, integrity, and availability with a CVSS score of 7.8.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized code execution, data access, or modification. As a command injection flaw, it allows attackers to run arbitrary commands as the invoking user, potentially leading to data breaches or unauthorized system changes. Such breaches could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Avoid installing or rebuilding source RPMs from untrusted sources. Verify RPM files with rpm -K <file> before processing. Update RPM to the latest patched version if available. Monitor system logs for unusual activity during RPM operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart