CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)
Hammer CLI fixed CVE-2026-12545, a local editor command injection that can escalate privileges.
Hammer CLI, the command-line interface for Foreman, fixed CVE-2026-12545, an editor command-injection flaw. A local attacker who can influence the editor configuration can cause commands to run when a user starts the affected editor flow. If Hammer CLI runs with elevated privileges, the bug can lead to privilege escalation. Affected versions are 0.15.1 through 3.19.0 and 5.0.0, with fixes in 3.19.1 and 5.0.1.
- A local attacker who controls Hammer CLI's editor setting can run commands.
- If Hammer CLI is privileged, the flaw can escalate privileges.
- Affects Hammer CLI 0.15.1 through 3.19.0 and 5.0.0.
- Fixed in Hammer CLI 3.19.1 and 5.0.1; no active exploitation reported.
Vulnerabilities mentionedAll →
- CVE-2026-125456.7—Command injection in Hammer CLI via EDITORpublished · Red Hat Hammer CLI (rubygem-hammer_cli)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12545 | Command injection in Hammer CLI via EDITOR CVE-2026-12545 is an OS command injection flaw in Hammer CLI (rubygem-hammer_cli) and in the Railties component shipped with Red Hat Satellite. The $EDITOR environment variable is interpolated into a single string passed to Ruby's system(), which runs /bin/sh and therefore treats metacharacters such as ;, |, and & as shell syntax. A local attacker who can influence EDITOR and induce a user to invoke the editor path can run arbitrary commands with the privileges of that Hammer process, with high impact to confidentiality, integrity, and availability. The issue is local, needs low privileges and user interaction, and is rated high attack complexity (CVSS 3.1 base 6.7). It is not in CISA KEV, and no public proof of concept is known. Upgrade Hammer CLI to 3.19.1 or 5.0.1 on the matching release line, and apply the Red Hat Satellite update that replaces the bundled Railties component. Until then, do not run Hammer editor flows with an untrusted EDITOR value, and restrict who can set that variable in admin environments. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Hammer CLI, a command-line interface for Foreman. CVE-2026-12545: Hammer CLI: editor command injection A local attacker who can influence Hammer CLI's editor configuration can cause commands to execute when a user invokes the affected editor flow. If Hammer CLI runs with elevated privileges, this can result in privilege escalation. Affected versions: Hammer CLI 0.15.1 through 3.19.0, and 5.0.0...
This source does not provide full text. Read it at seclists.org.