CVE-2026-84837: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Hardened Images

This vulnerability exists in the rpm package within Red Hat Hardened Images, where improper neutralization of special elements in the path or filename of tarballs processed by rpmbuild (-t*) allows an attacker to inject OS commands. The flaw is particularly relevant in automated build or continuous integration environments that ingest externally supplied artifact names. Exploitation results in arbitrary command execution with build user privileges. Red Hat issued an advisory (RHSA-2026:82378) and released updated rpm packages (version 6.1.0-1.3.hum1) to fix this vulnerability.

An attacker able to influence tarball paths or filenames processed by rpmbuild can execute arbitrary commands with the privileges of the build user. This can lead to information disclosure and disruption of the build environment. The CVSS 3.1 score is 7.8 (high severity) reflecting local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released updated rpm packages (version 6.1.0-1.3.hum1) that address this vulnerability. Users of Red Hat Hardened Images should apply these security updates promptly. Refer to the Red Hat advisory RHSA-2026:82378 for detailed update instructions. No additional mitigations are indicated by the vendor advisory.