The vulnerability in yggdrasil-worker-package-manager arises from improper neutralization of argument delimiters in command execution within the APT backend. Specifically, package names beginning with a hyphen can be interpreted as command-line options by apt-get, enabling an attacker with local access to inject arguments that lead to remote code execution with root privileges. This vulnerability is tracked as CVE-2026-18157 and carries a CVSS 3.1 score of 7.8 (high severity). The affected versions include =0.2.0, <0.1.4, and >=0.2.0 <0.2.4. The vendor advisory from Red Hat confirms the issue but does not currently specify a remediation level or patch availability.

Successful exploitation allows a local attacker with low privileges to execute arbitrary code as root, compromising the system's confidentiality, integrity, and availability. This results in full system compromise.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18157 for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to package management commands. No official fix or temporary mitigation is currently documented by the vendor.