Description

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-02T16:17:33.560Z",
  "pubdate": "2026-09-02T16:17:33.560Z",
  "executiveSummary": "A critical command injection vulnerability exists within the rpm package manager, specifically affecting the 'rpmbuild' utility when processing tarball files.\nThe vulnerability arises due to insufficient sanitization of file paths or filenames during the 'rpmbuild -t*' operation, allowing an attacker to inject arbitrary shell metacharacters.\nSuccessful exploitation enables remote code execution with the permissions of the user initiating the build process. This poses a significant risk to automated CI/CD pipelines and build systems that ingest untrusted or externally sourced build artifacts.\nAn attacker can gain unauthorized control over the build environment, leading to potential information disclosure, modification of build outputs, or full system compromise of the CI runner.\nThe vulnerability is primarily triggered when the build system blindly trusts filename parameters provided within an archive or as input to the build command.\nMitigation requires careful validation of input file names and restriction of input sources for automated build processes.",
  "technicalDetails": "The vulnerability resides in the command-line parsing logic of 'rpmbuild' when utilized with the '-t' (or --target) flag in conjunction with tarball processing.\nThe root cause is the improper handling of untrusted input strings passed to the underlying system shell. When 'rpmbuild' processes a tarball, it may pass file paths or filenames directly to system commands without adequate shell escaping or sanitization.\nIf an attacker provides a maliciously crafted filename (e.g., containing backticks, semicolons, or other shell metacharacters), the interpreter executing the command will evaluate these characters as active instructions rather than literal string data.\nThe attack flow typically follows these stages: 1) The attacker packages a malicious archive with a filename designed to contain shell operators; 2) The file is submitted to a build environment that utilizes 'rpmbuild -t' to automate the package creation process; 3) 'rpmbuild' parses the filename while invoking external tools or internal shell-based sub-processes; 4) The shell interprets the metacharacters, executing the attacker-supplied payload; 5) The payload executes with the privileges of the user running the build process.\nBecause 'rpmbuild' is frequently invoked within CI/CD pipelines to build packages from source code repositories or user-provided artifacts, the exploit surface is wide. An attacker with the ability to influence the naming conventions of the repository or the files being passed to the CI runner can trigger the execution.\nPost-exploitation impact is severe, as the attacker effectively gains the ability to execute arbitrary commands within the build environment. This could allow for exfiltration of environment variables, source code, or internal security credentials. Furthermore, an attacker could inject persistent backdoors into the resulting RPM packages, facilitating downstream supply chain attacks against end-users of the generated software.\nThe vulnerability does not necessarily require direct network-based exploitation of a service; rather, it is an injection vector triggered by the ingestion of malicious data, making it a critical threat to automated build systems."
}