CVE-2026-95521

HighCVSS 7.8/10Last modified Sep 24, 2026

Description

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 24, 2026
Last modified
Sep 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-955227.6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.CVE-2026-955236.5Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-955245.3Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-955256.5Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.CVE-2026-955267.3Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.CVE-2026-955276.5Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-955287.1Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.CVE-2026-955297.1Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.CVE-2026-955306.5Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.CVE-2026-955318.8Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.CVE-2026-955348.8Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allCVE-2026-95576.4A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs,
CVE-2026-95521: High severity, CVSS 7.8 | Vulnix