CVE-2026-84838: rpmuncompress Command Injection RCE Vulnerability

CVE-2026-84838 Overview

CVE-2026-84838 is a command injection vulnerability in rpmuncompress, a helper utility used by the RPM Package Manager to decompress archive files. The flaw allows a local attacker to execute arbitrary shell commands by supplying a specially crafted archive filename containing shell metacharacters. The utility fails to escape these characters before embedding the filename in a shell command string. Successful exploitation requires user interaction, such as a user or automated build workflow invoking rpmuncompress on the malicious file. The vulnerability is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact

Local attackers can execute arbitrary commands with the privileges of the user or automation process that invokes rpmuncompress, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

• RPM Package Manager (rpmuncompress component)
• Red Hat Enterprise Linux distributions shipping the affected rpm package (see Red Hat CVE-2026-84838 Advisory)
• Downstream Linux distributions and build systems that invoke rpmuncompress on untrusted filenames

Discovery Timeline

• 2026-09-02 - CVE CVE-2026-84838 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84838

Vulnerability Analysis

The vulnerability resides in how rpmuncompress constructs the shell command line used to invoke external decompression utilities. The tool accepts an archive filename as input and passes that filename into a shell command string without sanitization or safe argument passing. When the filename contains shell metacharacters such as backticks, $(), ;, |, or &, the shell interprets those characters as command syntax rather than as part of the filename.

A local attacker who can influence the filename processed by rpmuncompress can therefore cause arbitrary commands to run in the invoking user's context. In build pipelines and packaging automation that iterate over user-supplied archives, this can extend the blast radius from a single interactive user to any account that processes attacker-controlled files.

Root Cause

The root cause is unsafe construction of a shell command string that concatenates an untrusted filename directly into the command. Secure alternatives include invoking the decompressor with execve-style argument arrays rather than a shell, or applying strict allow-list validation on the filename before use. See the Red Hat Bug Report #2462222 for details.

Attack Vector

Exploitation is local and requires user interaction. An attacker stages an archive on the target system with a filename containing shell metacharacters, for example an embedded command substitution sequence. When a user, cron job, or CI/CD workflow invokes rpmuncompress against that filename, the embedded payload executes with the caller's privileges. No authentication is required to place the file if the attacker already has write access to a shared directory processed by an automated workflow.

No verified proof-of-concept code is publicly available. Refer to the Red Hat CVE-2026-84838 Advisory for authoritative technical details.

Detection Methods for CVE-2026-84838

Indicators of Compromise

• Presence of files in build, staging, or upload directories whose names contain shell metacharacters such as `, $(, ;, |, &, or newline characters.
• Unexpected child processes such as /bin/sh, bash, curl, wget, or nc spawned as descendants of rpmuncompress.
• Shell history or audit records showing rpmuncompress invocations against filenames with unusual punctuation.

Detection Strategies

• Monitor process ancestry for rpmuncompress spawning shells or network utilities, which is not part of normal decompression behavior.
• Enable Linux audit rules (auditd) on execve events where the executable path is rpmuncompress and capture the full argument vector for later review.
• Alert on filesystem events that create files with metacharacter-laden names in directories consumed by packaging pipelines.

Monitoring Recommendations

• Ingest auditd and process telemetry from build servers and developer workstations into a centralized analytics platform for correlation across hosts.
• Baseline the normal command-line arguments passed to rpmuncompress and alert on deviations, particularly filenames containing shell control characters.
• Review CI/CD job logs for rpmuncompress invocations against artifacts sourced from untrusted contributors.

How to Mitigate CVE-2026-84838

Immediate Actions Required

• Apply the vendor-supplied rpm package update as soon as it is available from your Linux distribution.
• Audit build systems, package repositories, and shared upload directories for archive files with suspicious filenames and quarantine them.
• Restrict write access to directories whose contents are later processed by rpmuncompress in automated workflows.

Patch Information

Consult the Red Hat CVE-2026-84838 Advisory for authoritative package versions and errata. Track upstream fixes in the Red Hat Bug Report #2462222. Rebuild any downstream distributions or container images that bundle the affected rpm binaries once patches are available.

Workarounds

• Avoid invoking rpmuncompress on archives whose filenames originate from untrusted sources until patched.
• Wrap invocations in scripts that validate filenames against a strict allow-list of characters (for example [A-Za-z0-9._-]) before passing them to rpmuncompress.
• Run packaging and build workflows under least-privilege service accounts to limit the impact of successful command injection.

# Example filename validation before invoking rpmuncompress
fname="$1"
case "$fname" in
  *[!A-Za-z0-9._/-]*)
    echo "Rejected: filename contains disallowed characters" >&2
    exit 1
    ;;
esac
rpmuncompress -- "$fname"