CVE-2026-84837

Name of the Vulnerable Software and Affected Versions rpm (affected versions not specified)

Description A command injection flaw exists in rpm. An attacker can execute arbitrary commands with the privileges of the build user by influencing the path or filename of a tarball processed by the rpmbuild -t* function to include shell metacharacters. This issue is especially critical in automated build or continuous integration (CI) workflows that process artifact names supplied by external sources, potentially leading to information disclosure or disruption of the build environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.