AI analysis
CVE-2026-12545 is an OS command injection flaw in Hammer CLI (rubygem-hammer_cli) and in the Railties component shipped with Red Hat Satellite. The $EDITOR environment variable is interpolated into a single string passed to Ruby's system(), which runs /bin/sh and therefore treats metacharacters such as ;, |, and & as shell syntax. A local attacker who can influence EDITOR and induce a user to invoke the editor path can run arbitrary commands with the privileges of that Hammer process, with high impact to confidentiality, integrity, and availability. The issue is local, needs low privileges and user interaction, and is rated high attack complexity (CVSS 3.1 base 6.7). It is not in CISA KEV, and no public proof of concept is known.
What to do: Upgrade Hammer CLI to 3.19.1 or 5.0.1 on the matching release line, and apply the Red Hat Satellite update that replaces the bundled Railties component. Until then, do not run Hammer editor flows with an untrusted EDITOR value, and restrict who can set that variable in admin environments.
Affected
| Red Hat Hammer CLI (rubygem-hammer_cli) | Releases before the fixes in 3.19.1 and 5.0.1 |
| Red Hat Satellite (bundled Railties) | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).