CVE-2026-84837 Red Hat CVE debrief

Who should care

Teams responsible for automated build or CI workflows, especially those ingesting externally supplied artifact names, should be aware of this vulnerability and take defensive actions to prevent exploitation. This includes reviewing and validating externally supplied artifact names and paths, implementing strict input validation and sanitization for tarball filenames and paths, and monitoring and restricting the execution of commands with elevated privileges. Additionally, security teams and vulnerability management teams should prioritize defensive actions due to the HIGH CVSS score of 7.8 and potential for arbitrary command execution.

Technical summary

A command injection vulnerability exists in rpm when processing tarballs with `rpmbuild -t*`. An attacker can exploit this by including shell metacharacters in the path or filename of a tarball, potentially leading to arbitrary command execution with the privileges of the build user. This vulnerability is particularly relevant in automated build or CI workflows that ingest externally supplied artifact names. The vulnerability allows for arbitrary command execution with the privileges of the build user, potentially leading to information disclosure or disruption of the build environment. Defensive actions should include reviewing externally supplied artifact names and paths, implementing strict input validation and sanitization, and monitoring command execution with elevated privileges.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 7.8 and potential for arbitrary command execution.

Recommended defensive actions

• Review and validate externally supplied artifact names and paths in automated build or CI workflows.
• Implement strict input validation and sanitization for tarball filenames and paths.
• Monitor and restrict the execution of commands with elevated privileges.
• Consider compensating controls, such as restricting access to build environments.
• Verify and apply vendor remediation or patches for the rpm vulnerability.

Evidence notes

Evidence is limited; primary official records indicate a command injection vulnerability in rpm, particularly relevant in automated build or CI workflows. Further verification is needed. The vulnerability allows for arbitrary command execution with the privileges of the build user, potentially leading to information disclosure or disruption of the build environment. Defensive verification tasks should include reviewing externally supplied artifact names and paths, implementing strict input validation and sanitization, and monitoring command execution with elevated privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.