A flaw in the rubygem-hammer_cli package enables an attacker to inject arbitrary shell commands through the $EDITOR environment variable. The Ruby application passes this value directly into a system() call, which interprets shell metacharacters and executes the constructed command string. This reflects the common Command Injection weakness (CWE‑78) and could allow an attacker to run commands with the privileges of the Satellite service, compromising confidentiality, integrity, and availability.

The vulnerability applies to Red Hat Satellite 6 and the 6.19 release for RHEL 9. It is present in the Hammer CLI component and the accompanying Rails (Railties) libraries bundled with these Satellite installations. The affected products are enumerated by the vendor as "Red Hat:Red Hat Satellite 6" and "Red Hat:Red Hat Satellite 6.19 for RHEL 9". No specific minor release information is disclosed beyond these identifiers; users of any Satellite 6 or 6.19 installation should verify their installed version of rubygem‑hammer_cli against the Red Hat erratum RHSA‑2026:74503.

The CVSS score of 6.7 classifies the vulnerability as moderate to high risk. EPSS information is not available, indicating that the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to influence the $EDITOR environment variable used by the Satellite service, which may be feasible if the attacker can interfere with the execution environment or supply configuration data. If exploited, the attacker could execute arbitrary commands on the Satellite host with escalating privileges, potentially taking full control of the asset.