CVE-2026-95521 — Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attac…
Published: 2026-09-24 · CVSS: 7.8 · CVSS 3.1
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7