CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
Attackers can execute arbitrary commands via shell metacharacters in tarball paths processed by rpmbuild, impacting build environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84837?
CVE-2026-84837 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 2 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
Weakness: CWE-78
Which versions are affected by CVE-2026-84837?
How do I fix CVE-2026-84837?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-84837 being exploited?
There is no known exploitation of CVE-2026-84837 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792769939, CLSA-2026-1792770120, DEBIAN-CVE-2026-84837, ECHO-9c44-f69c-dc26, GHSA-7m7j-6vw6-f549, UBUNTU-CVE-2026-84837.