CVE-2026-95521
7.8 HIGHPublished 2026-09-24 · Updated 2026-09-24
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2022-51019PoC
- HIGHCVE-2025-14754
- HIGHCVE-2026-100292
- HIGHCVE-2026-100368PoC
- UNSCOREDCVE-2026-100382
- HIGHCVE-2026-100559PoC
- HIGHCVE-2026-100599PoC
- HIGHCVE-2026-100844PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.