CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

This issue is rated Moderate because, although successful exploitation allows arbitrary command execution as the invoking (typically non-root) user, it requires a user or automated workflow to install or rebuild an untrusted source RPM. The vulnerable code is not exposed as a network service and cannot be triggered without that local processing step.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, Red Hat recommends avoiding the installing or rebuilding of source RPMs from untrusted or unverified sources.