HIGH 7.8 NVD

CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

References

https://access.redhat.com/security/cve/CVE-2026-95521
https://bugzilla.redhat.com/show_bug.cgi?id=2537812

Published: 2026-09-24 · Source: NVD · Feed updated: 2026-09-24

This high severity vulnerability with a CVSS score of 7.8 was published on 2026-09-24 via NVD.

vulnfeed aggregates 11976 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.