Command Injection in RPM Package Manager

CVE-2026-95521 is a high-severity command injection vulnerability identified in the rpm package manager. The flaw arises from insecure handling of source RPM files during installation or rebuild operations. When rpm processes a source RPM where the source or spec file basenames contain a %() macro construct, the package manager improperly invokes popen() to relocate the source file list. This execution path results in the arbitrary execution of attacker-supplied shell commands under the context of the user running the command, which may include build agents, developers, or system administrators. Because this logic is triggered by standard package processing workflows, it poses a significant risk to CI/CD pipelines and environments that ingest untrusted or third-party source packages.

Impact

Successful exploitation allows for arbitrary code execution on any system that processes a malicious .src.rpm file. The impact is significant for build infrastructure, development environments, and automated packaging systems, as an attacker can gain the privileges of the user running the rpm command to perform post-exploitation activities, such as credential theft or lateral movement within the build environment.

Recommendation

• Identify all systems and CI/CD runners utilizing the rpm package manager for rebuilding or installing source packages.
• Prioritize patching the rpm package as soon as security updates are provided by the vendor.
• Implement strict verification controls for incoming .src.rpm files from untrusted third-party sources.
• Audit build logs for occurrences of unexpected subshell execution or shell metacharacters within filenames handled by rpm.