Command Injection in rpm via Crafted .gem Filenames

A security flaw identified as CVE-2026-84233 exists within the rpm utility, specifically affecting how it handles file operations. A local attacker can create a specially crafted .gem file with a filename that embeds RPM macro syntax. When a local user or an automated build/deployment workflow executes the rpmuncompress -x command on the malicious file, the internal command construction logic improperly expands these macros. This expansion leads to the execution of arbitrary commands under the security context of the user or service account initiating the process. This vulnerability poses a significant risk to the integrity and confidentiality of Linux systems that rely on rpm for package handling or automated artifact processing. Defenders should prioritize identifying environments where rpm is used to process untrusted or externally sourced .gem files.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute commands with the privileges of the invoking account. This can result in full system compromise if the rpmuncompress utility is invoked by privileged users or automated root-level service accounts. The vulnerability affects the rpm utility, a foundational component for software packaging on many Linux distributions.

Recommendation

1. Inventory all internal build systems and automated workflows that utilize the rpmuncompress utility to process .gem files.
2. Implement strict input validation on filenames before passing them to the rpmuncompress utility in automated pipelines.
3. Update the rpm package to the latest version provided by the distribution vendor to remediate CVE-2026-84233.
4. Restrict file system permissions to prevent untrusted local users from placing files in directories monitored by automated build agents.