Description

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-01T15:17:43.853Z",
  "pubdate": "2026-09-01T15:17:43.853Z",
  "executiveSummary": "A command injection vulnerability exists within the rpm utility, specifically involving the rpmuncompress function. The flaw arises from improper handling of user-supplied filenames containing RPM macro syntax when processed during command construction.\nA local attacker can exploit this by crafting a .gem file with a malicious filename that, when passed to rpmuncompress -x, triggers unintended macro expansion. This leads to arbitrary command execution with the privileges of the user or automated workflow invoking the tool.\nThe vulnerability affects the confidentiality, integrity, and availability of the host system. Successful exploitation allows an attacker to execute commands as the invoking account, potentially leading to privilege escalation if the tool is run with elevated permissions. This flaw is particularly concerning in automated environments such as CI/CD pipelines or automated package management workflows where untrusted files might be processed.\nThe attack is localized to the system where the command is executed and does not require network exposure, but it relies on the interaction between the rpm utility and specifically named files.",
  "technicalDetails": "The root cause of this vulnerability is an unsafe string handling mechanism within the rpmuncompress utility. When the utility processes a .gem archive, it must construct shell commands or internal processes to handle the decompression of file contents. During this construction phase, the filename of the archive is passed into an environment where RPM's internal macro expansion engine is active.\nRPM macros are character sequences (typically enclosed in %{...}) that the RPM engine interprets and expands before executing associated system calls. If a filename contains such sequences, the parser treats them as legitimate instructions rather than literal strings. When rpmuncompress -x is executed on a maliciously crafted filename, the macro engine performs recursive expansion, translating the attacker's input into executable shell commands.\nThe exploitation flow proceeds as follows: 1) The attacker creates a file with a name containing specific RPM macro syntax, for example, a name involving %{lua:os.execute('command')}. 2) The attacker places this file in a directory where an automated system or a local user will trigger rpmuncompress -x. 3) Upon invocation, the utility passes the filename to the command constructor. 4) The RPM macro expansion engine triggers, evaluating the embedded command. 5) The shell or system interpreter executes the injected payload with the permissions of the user running the utility.\nThis vulnerability effectively turns the rpmuncompress utility into an execution vector for local command injection. The impact is significant because it bypasses standard file-handling security, as the malicious code is not necessarily contained within the archive's payload, but resides in the metadata—the filename itself. This complicates traditional signature-based detection, as the archive contents may be benign, while the file system entry performs the malicious action. Post-exploitation, an attacker can leverage the compromised account to escalate privileges, install persistent backdoors, or exfiltrate sensitive data depending on the level of the invoking user's permissions."
}