---
id: CVE-2026-12545
title: A flaw was found in rubygem-hammer_cli
summary: >-
  A flaw was found in rubygem-hammer_cli. A command injection vulnerability
  exists in Hammer CLI and the Railties (Ruby on Rails) component distributed
  with Satellite due to the insecure interpolation of the $EDITOR environment
  variable in…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Red Hat
product: rubygem-hammer_cli
affected:
  - rubygem-hammer_cli (all versions)
  - rubygem-hammer_cli (all versions)
  - rubygem-hammer_cli (all versions)
  - rubygem-hammer_cli (all versions)
  - rubygem-hammer_cli (all versions)
  - 'satellite-utils:el8/rubygem-hammer_cli (all versions)'
patched:
  - satellite_6_16_for_rhel 8
  - satellite_6_16_for_rhel 9
  - satellite_6_18_for_rhel 9
  - satellite_6_19_for_rhel 9
published: '2026-10-01'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T07:17:00.897'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12545'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:74503'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74504'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74505'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74506'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12545'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489993'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/07/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12545.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-12545'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12545'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T17:32:50.535068Z'
epss: 0.00523
epssPercentile: 0.44175
ingestedAt: '2026-10-01T18:55:42.369Z'
---

## Overview

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:74506** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74506)
- **RHSA-2026:74504** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74504)
- **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503)
- **Red Hat VEX** · Moderate · affected: Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12545.json)
- **RHSA-2026:74505** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74505)