AZL-105326
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105326.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-105326
- Upstream
- CVE-2026-95521
- Published
- 2026-09-24T14:18:20Z
- Modified
- 2026-10-03T05:35:10Z
- Summary
- CVE-2026-95521 affecting package rpm 4.18.2-2
- Details
-
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.
- References