CVE-2026-84233: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Hardened Images

This vulnerability exists in the rpm utility used in Red Hat Hardened Images. When the rpmuncompress -x command processes a specially crafted .gem filename containing RPM macro syntax, it performs macro expansion during command construction. This improper neutralization of special elements leads to OS command injection, enabling a local attacker to execute arbitrary commands with the privileges of the user running the command. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Red Hat has issued a security advisory (RHSA-2026:66637) providing updated rpm packages to fix this issue.

Successful exploitation allows a local attacker to execute arbitrary commands with the privileges of the invoking user, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Red Hat has released updated rpm packages (version 6.1.0-1.hum1) that address this vulnerability. Users of Red Hat Hardened Images should apply the security update as detailed in Red Hat Advisory RHSA-2026:66637. No additional mitigation steps are indicated by the vendor.