CVE-2026-84233: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-84233 is an OS command injection vulnerability in the rpm package affecting the rpmuncompress utility. A local attacker can supply a specially crafted .gem filename containing RPM macro syntax (e.g., %(...)) that is evaluated during command construction when rpmuncompress -x is invoked, resulting in arbitrary command execution with the privileges of the invoking account. The vulnerability was reported on May 18, 2026, and publicly disclosed on September 1, 2026, with the affected component identified as rpm-4.19.1.1-23.el10. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In tools/rpmuncompress.c, the doUntar() function handles .gem files by extracting the basename of the supplied filename and passing it through rpmGetPath(), which internally calls rpmExpand(). The RPM macro engine treats %(...) as a shell escape and executes the embedded command via popen() in rpmio/macro.c (doShellEscape()). Critically, this macro expansion occurs during command string construction — before any dryrun check — meaning even rpmuncompress -n -x (dry-run mode) triggers execution of the payload. Exploitation requires no prior privileges; the attacker only needs to place a maliciously named .gem file and have a user or automated workflow invoke rpmuncompress -x on it (Red Hat Bugzilla).

Successful exploitation allows arbitrary OS command execution with the full privileges of the invoking user or automated build account, resulting in high impact to confidentiality, integrity, and availability. An attacker can read or exfiltrate sensitive files, modify or delete data, terminate processes, or establish persistence within the invoking account's context. In CI/CD or automated build environments where rpmuncompress processes externally sourced .gem archives, the blast radius extends to build artifacts, secrets, and downstream pipeline components (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept is documented in the Red Hat Bugzilla report, demonstrating that creating a file named foo%(touch /tmp/rpm_macro_poc).gem with minimal content and running rpmuncompress -n -x on it is sufficient to trigger command execution. As of the disclosure date (September 1, 2026), the CVE status is "Awaiting Analysis" with no released package fix and no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Attack complexity is rated High due to the requirement for user or workflow interaction with a crafted filename (Red Hat Bugzilla, GitHub Advisory).

1. Craft the malicious filename: Create a .gem file whose basename contains an RPM macro shell escape payload, e.g.:

printf '1234567890123' > 'foo%(touch /tmp/rpm_macro_poc).gem'

2. Deliver the file: Place the crafted .gem file in a location accessible to the target user or automated build workflow (e.g., a shared source directory, package repository, or uploaded artifact).
3. Trigger extraction: Wait for or socially engineer the target user or CI/CD pipeline to invoke rpmuncompress -x on the crafted file:

rpmuncompress -x 'foo%(touch /tmp/rpm_macro_poc).gem'

4. Macro expansion executes payload: During command string construction in doUntar(), rpmGetPath() passes the filename-derived string through rpmExpand(), which evaluates %(touch /tmp/rpm_macro_poc) via popen(), executing the embedded shell command.
5. Verify execution: Confirm the side effect (e.g., ls -l /tmp/rpm_macro_poc). Replace the benign touch command with a more impactful payload (reverse shell, credential theft, persistence mechanism) targeting the invoking account's privileges (Red Hat Bugzilla).

• File System: Unexpected files created in /tmp/ or other writable directories with names suggesting automated creation (e.g., rpm_macro_poc); presence of .gem files with unusual characters such as %, (, ) in their filenames in source or build directories.
• Process: Unexpected child processes spawned by rpmuncompress (e.g., sh, bash, curl, wget, python) visible in process trees; popen()-initiated shell commands appearing in process audit logs.
• Logs: Audit log entries (auditd) showing execve syscalls initiated by rpmuncompress for commands not related to gem extraction; RPM macro expansion errors or unexpected output in build system logs.
• Network: Outbound connections from build servers to unknown external IPs initiated shortly after rpmuncompress invocation, potentially indicating reverse shell or data exfiltration payloads (Red Hat Bugzilla).

No released package fix was available as of the disclosure date (September 1, 2026); a tracker has been filed for RHEL 10.3 (RHEL-189190). The primary workaround is to avoid invoking rpmuncompress -x on untrusted or externally sourced .gem filenames. Before extraction, rename or sanitize .gem filenames to remove RPM macro syntax characters (%, (, )). In automated build environments, implement input validation to reject source archive names containing macro syntax prior to extraction. The proposed upstream fix replaces the rpmGetPath() call with plain string concatenation (rstrscat()) for .gemspec path construction, eliminating macro evaluation of attacker-controlled input (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported via Red Hat's coordinated disclosure process. The Bugzilla report notes the initial analysis was AI-generated and flagged for human review prior to use. Social media activity is minimal, with only a single Mastodon post from RedPacketSecurity observed shortly after disclosure. No significant vendor statements beyond Red Hat's CVE page or notable independent researcher commentary have been published as of the disclosure date (Red Hat CVE, Red Hat Bugzilla).