CVE-2026-84233: RPM Package Manager RCE Vulnerability

CVE-2026-84233 Overview

CVE-2026-84233 is a command injection vulnerability in the RPM Package Manager (rpm). The flaw resides in rpmuncompress -x handling of filenames containing RPM macro syntax. A local attacker can craft a .gem filename embedding macro directives that expand during command construction, resulting in arbitrary command execution under the invoking user's privileges. The weakness is classified as [CWE-78] (OS Command Injection). Exploitation requires user interaction or an automated workflow that processes attacker-supplied filenames.

Critical Impact
Successful exploitation yields arbitrary command execution with full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Red Hat distributions shipping vulnerable versions of rpm
Systems using rpmuncompress -x in build or packaging workflows
Automated pipelines processing untrusted .gem files with RPM tooling

Discovery Timeline

2026-09-01 - CVE-2026-84233 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84233

Vulnerability Analysis

The rpmuncompress utility extracts compressed archives referenced during package build operations. When invoked with -x and a filename argument, the utility constructs an underlying shell command to perform extraction. RPM's macro engine expands %{...} directives inside strings before command execution. Because filenames are not sanitized against macro syntax, an attacker who controls a filename can inject arbitrary macros. Those macros expand into shell metacharacters or full commands, which the shell then executes.

The issue is a classic command injection [CWE-78] surfaced through a domain-specific expansion layer rather than the shell parser itself. Exploitation is local, requires user interaction, and has high attack complexity because the attacker must place the malicious filename where a user or automated workflow will process it with rpmuncompress -x.

Root Cause

The root cause is untrusted input flowing into RPM macro expansion during command construction in rpmuncompress. Filenames are treated as trusted strings and passed through the macro engine before shell invocation. There is no escaping of %{...} sequences or shell metacharacters embedded in the resolved filename.

Attack Vector

An attacker stages a .gem file whose name contains RPM macro syntax invoking commands, for example a name embedding %(...) shell-expansion macros. When a user or CI job runs rpmuncompress -x against this file, macro expansion resolves the embedded directive and executes the attacker's payload with the caller's privileges. Common vectors include shared build directories, gem mirrors, developer downloads, and automated packaging pipelines that fetch third-party artifacts.

No verified public proof-of-concept is available. Refer to the Red Hat CVE-2026-84233 Advisory and Red Hat Bug Report #2478409 for technical details.

Detection Methods for CVE-2026-84233

Indicators of Compromise

Filenames on disk containing RPM macro syntax such as %{, %(, or backtick sequences, particularly with .gem extensions
Unexpected child processes spawned by rpmuncompress, rpmbuild, or gem-to-rpm conversion tooling
Shell interpreters (/bin/sh, /bin/bash) invoked as descendants of rpmuncompress outside of normal extraction behavior
Outbound network connections initiated from build or packaging user contexts immediately after RPM tooling execution

Detection Strategies

Alert on process executions where rpmuncompress is the parent of a shell or scripting interpreter
Inspect command-line arguments passed to rpmuncompress for % characters, parentheses, or braces inside filename tokens
Correlate file-creation events for .gem files with subsequent rpmuncompress -x invocations to reconstruct the attack chain

Monitoring Recommendations

Enable audit logging (auditd) for execve events involving rpmuncompress and record full command lines
Monitor CI/CD job logs for gem or RPM build steps that reference externally supplied artifact names
Review shared upload directories and package caches for filenames containing macro metacharacters

How to Mitigate CVE-2026-84233

Immediate Actions Required

Apply the vendor-supplied rpm update as tracked in the Red Hat CVE-2026-84233 Advisory once available for your distribution
Restrict which users and automation accounts can invoke rpmuncompress on externally sourced files
Audit build systems and gem-to-rpm workflows for filenames containing %, {, }, (, or ` characters and quarantine matches

Patch Information

Refer to the Red Hat CVE-2026-84233 Advisory and Red Hat Bug Report #2478409 for fixed package versions and errata identifiers per supported release. Apply distribution updates through the standard package manager and rebuild any container images that ship the vulnerable rpm binary.

Workarounds

Validate and rename incoming .gem filenames to a safe character set before passing them to rpmuncompress
Run packaging workflows under least-privilege service accounts isolated from sensitive credentials and data
Reject build inputs whose filenames contain RPM macro metacharacters at ingestion time in CI pipelines

bash

# Reject filenames containing RPM macro metacharacters before invoking rpmuncompress
for f in *.gem; do
  case "$f" in
    *%*|*\{*|*\}*|*\(*|*\)*|*\`*)
      echo "Rejected unsafe filename: $f" >&2
      exit 1
      ;;
  esac
done
rpmuncompress -x "$f"