https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T08:27:20.717223+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-95521 fkie_cve-2026-95521 2026-09-30T08:27:20.720496+00:00

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

 https://vulnerability.circl.lu/vuln/ghsa-7prr-g333-3h48 GHSA-7prr-g333-3h48 2026-09-30T08:27:20.720592+00:00

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-95521 UBUNTU-CVE-2026-95521 2026-09-30T08:27:20.720629+00:00

Affected: Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:26.04:LTS: rpm

(A command injection flaw was found in rpm. Installing or rebuilding a ...)