Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by redhat

CVE-2026-84837Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

High 7.8

In plain English

A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-84837
Debian:13rpmno fix listedDEBIAN-CVE-2026-84837
Debian:14rpmno fix listedDEBIAN-CVE-2026-84837
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-84837
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-84837
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-84837
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-84837

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References