pyp2spec was generating Fedora RPM spec files from Python project metadata. Prior to version 0.14.1, the tool wrote the package summary field directly into the spec file without escaping RPM macro syntax. When a builder ran rpmbuild, those unsanitized macro directives were interpreted and executed, giving an attacker the ability to run arbitrary commands on the build host. This is a classic code‑injection flaw that compromises the integrity and confidentiality of the build environment.

All installations of befeleme pyp2spec older than version 0.14.1 are vulnerable. Any build workflow that processes PyPI metadata with this tool and subsequently invokes rpmbuild is at risk.

The CVSS score of 7.8 indicates high severity, but the EPSS score is unavailable, so exact exploitation likelihood is unknown. The vulnerability is not listed in CISA KEV. Attackers would need to supply or influence PyPI package metadata for a target, such as an untrusted package or a malicious contributor. Based on the description, it is inferred that the attack vector is local, requiring control over the metadata source or the build process. If executed, an attacker can achieve arbitrary command execution on the build machine.