CVE-2026-84837High· 7.8▾ TwilightA flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
1.2% → 1.3%
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t* to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84838High· 7.8A flaw was found in rpmuncompress
CVE-2026-78367High· 7.0A vulnerability was found in RPM's rpmbuild tarball processing
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)
CVE-2026-101720Medium· 5.3mysql: mysql: unauthorized data modification via connection handling (CVE-2026-101720)
CVE-2026-107928Medium· 4.8curl: curl: info leak uploading over WebSockets with GnuTLS (CVE-2026-107928)
CVE-2026-107929Low· 3.7curl: curl: local interface connection reuse mixup (CVE-2026-107929)