CVE-2026-84233

CVE-2026-84233 is an operating-system command injection flaw (CWE-78) in rpmuncompress, a utility shipped with the RPM package manager. It triggers when a user or automated workflow runs rpmuncompress -x against a .gem archive whose filename contains RPM macro syntax: during construction of the extraction command the filename is macro-expanded, so commands embedded in the name are executed. An attacker who can get such a file processed gains arbitrary command execution with the privileges of the invoking account, compromising the confidentiality, integrity and availability of that host. Any RPM-based Linux environment where externally supplied .gem files are unpacked, including build and CI pipelines or packaging scripts, is potentially exposed; the source data provides no specific affected or fixed version numbers. There are no reports of in-the-wild exploitation: no public proof-of-concept is known, it is not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation within 30 days.

What to do: Apply the rpm security update for your distribution as soon as a fixed version is published, tracking advisories from Red Hat and other RPM-based vendors since no fixed version number is given in the source data. Until patched, avoid running rpmuncompress -x on .gem files from untrusted sources, or confine such processing to sandboxed build environments. Audit rpmbuild specs, gem2rpm-style automation and CI jobs for steps that unpack externally supplied .gem archives.