CVE-2026-95519 in RPM
Summary
by MITRE • 09/24/2026
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the RPM Package Manager represents a critical security flaw rooted in improper handling of macro expansion within manifest files. When an attacker supplies a specially crafted manifest file, they exploit the fact that rpm processes these entries by unexpectedly expanding macros before attempting to open or read them. This behavior is particularly dangerous because it allows embedded shell commands contained within the manifest data to be executed directly by the rpm process. The flaw specifically affects workflows where users or automation tools invoke rpm with flags such as -q and -p, which are commonly used for querying package information from non-installed packages or manifests. Because macro expansion occurs prior to validation of the content's safety, malicious payloads disguised within standard manifest structures can bypass security checks that would otherwise prevent arbitrary command execution.
From a technical perspective, this issue stems from a failure in input sanitization and context-aware processing. RPM is designed to support complex dependency resolution and package metadata management through its macro system, which allows for dynamic content generation during installation or querying. However, the application of these macros to untrusted manifest inputs without adequate isolation creates an execution environment where attacker-controlled data becomes executable code. The operational impact is severe, as successful exploitation leads to arbitrary code execution with the privileges of the user running rpm or any automation service invoking it. This means that if a system administrator runs such a command on their workstation, they may compromise their own account, while automated build systems or CI/CD pipelines could result in broader infrastructure compromise. The attacker gains full control over confidentiality, integrity, and availability for the affected context, potentially leading to data exfiltration, modification of critical system files, or disruption of services dependent on package management operations.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) as it involves the injection of malicious commands through manipulated input that is subsequently executed by a privileged process. Additionally, from a threat modeling perspective using MITRE ATT&CK, this flaw facilitates techniques associated with Execution via System Utilities and potentially Persistence if the compromised rpm instance allows for further payload deployment. The attack vector typically requires user interaction or access to an automation pipeline where manifest files are processed, making social engineering or supply chain compromise potential initial steps for adversaries aiming to exploit this weakness.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users should immediately update rpm to a patched version that addresses the macro expansion behavior in manifest processing flows. Until updates are applied, administrators should avoid using rpm -q -p or similar commands with manifests sourced from untrusted or external parties. Automation pipelines integrating RPM operations must implement strict validation of input files and consider sandboxing these processes to limit potential damage. Furthermore, developers reviewing code that interacts with RPM APIs should ensure that any user-supplied data passed through macro expansion functions is rigorously sanitized or processed in a restricted context where command execution capabilities are disabled. Regular security audits focusing on package management tools can help identify similar vulnerabilities before they are exploited in production environments.