The flaw in yggdrasil‑worker‑package‑manager allows a local attacker to inject arguments into the apt‑get backend by using package names that begin with a hyphen. These specially crafted names are interpreted as command options, enabling the attacker to execute arbitrary commands with root privileges, thereby fully compromising system integrity, confidentiality, and availability.

This vulnerability affects systems running Red Hat Enterprise Linux 10 that include the RedHatInsights yggdrasil‑worker‑package‑manager component. No specific version numbers are listed in the vulnerability data, so all installations of this package are potentially affected.

With a CVSS score of 7.8, the flaw is classified as high severity. The EPSS score of < 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access: an attacker must be able to run or otherwise trigger yggdrasil‑worker‑package‑manager to leverage the argument‑injection vulnerability in the apt backend. Once triggered, the attacker can gain root privileges and execute arbitrary commands, making the system fully compromised. While the vulnerability is potent, it remains limited to environments where yggdrasil‑worker‑package‑manager is present and reachable by a local user.