CVE-2026-12545

Name of the Vulnerable Software and Affected Versions rubygem-hammer cli (affected versions not specified)

Description Command injection is possible in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite. The issue occurs because the $EDITOR environment variable is insecurely interpolated into the Ruby system() function. When a single interpolated string is passed to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters such as ;, |, and &.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.