CVE-2026-12545 Rubygem-hammer_cli: command injection via insecure editor invocation
Attackers can execute arbitrary commands via shell metacharacters in the EDITOR variable due to insecure system() usage in Hammer CLI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12545?
CVE-2026-12545 is a medium-severity command injection vulnerability in Red Hat Satellite 6, published on 1 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).
Weakness: CWE-78
Which versions are affected by CVE-2026-12545?
How do I fix CVE-2026-12545?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-12545 being exploited?
There is no known exploitation of CVE-2026-12545 in the wild and no public exploit code.
Sources
Also known as GHSA-q4vv-h3wg-pwgx.