CVE-2026-95521 — Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

Description (CNA)

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Enterprise Linux 10	affected
Red Hat / Red Hat Enterprise Linux 6	unknown
Red Hat / Red Hat Enterprise Linux 7	affected
Red Hat / Red Hat Enterprise Linux 8	affected
Red Hat / Red Hat Enterprise Linux 9	affected
Red Hat / Red Hat Hardened Images	affected

CWE

CWE-78

References

https://access.redhat.com/security/cve/CVE-2026-95521
https://bugzilla.redhat.com/show_bug.cgi?id=2537812

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.