CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)
Hammer CLI fixed CVE-2026-12545, a local editor command injection that can escalate privileges.
Hammer CLI, the command-line interface for Foreman, fixed CVE-2026-12545, an editor command-injection flaw. A local attacker who can influence the editor configuration can cause commands to run when a user starts the affected editor flow. If Hammer CLI runs with elevated privileges, the bug can lead to privilege escalation. Affected versions are 0.15.1 through 3.19.0 and 5.0.0, with fixes in 3.19.1 and 5.0.1.
38