CVE-2026-95521

Name of the Vulnerable Software and Affected Versions rpm (affected versions not specified)

Description A command injection flaw exists when installing or rebuilding a source RPM. If the source or spec file basenames contain a %() macro construct, the software executes an attacker-controlled shell command via the popen() function during the relocation of the source file list. This allows for arbitrary command execution with the privileges of the user invoking the process, which is typically a non-root user, when processing an untrusted .src.rpm file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.