CVE-2026-84838: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Hardened Images

The vulnerability exists in the rpmuncompress command of Red Hat Hardened Images where shell metacharacters in archive filenames are not properly neutralized before being passed to shell commands. This improper neutralization allows a local attacker to execute arbitrary OS commands when rpmuncompress processes a maliciously crafted filename. Exploitation requires user interaction to invoke the vulnerable command on the crafted file. The issue affects the confidentiality, integrity, and availability of data accessible to the invoking user. Red Hat has issued a security advisory (RHSA-2026:82378) providing updated rpm packages that fix this issue.

An attacker with local access can execute arbitrary commands with the privileges of the user invoking rpmuncompress by exploiting this vulnerability. This can lead to full compromise of data confidentiality, integrity, and availability for that user context. The vulnerability requires user interaction, limiting remote exploitation. There are no known exploits in the wild at this time.

Red Hat has released fixed rpm packages version 6.1.0-1.3.hum1 that address this vulnerability. Users of Red Hat Hardened Images should apply the update provided in RHSA-2026:82378 to remediate this issue. No additional mitigation steps are required once the update is applied.