A crafted source tarball can be used in rpmbuild’s tarball mode to inject arbitrary macro expansions. The getTarSpec() function passes a tar member name directly into rpmExpand() as part of a %{basename:…} macro. Because the member name is user‑controlled, an attacker may embed Lua code that will be executed with the privileges of the user running rpmbuild. The flaw is a code injection vulnerability classified as CWE‑94, and its primary impact is the ability to execute arbitrary code on the build system.

The vulnerability affects the rpmbuild component used across several Red Hat distributions. Affected releases include Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. All of these products rely on the same rpmbuild engine, so any system that processes an untrusted source tarball with rpmbuild tarball mode is vulnerable.

With a CVSS score of 7 the vulnerability is considered high severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, suggesting no widely used exploit yet. Nonetheless, the attack path is simple: any user or automated build system that runs rpmbuild with the –ta, –tb, or –ts options against a malicious archive can trigger the macro expansion and run arbitrary Lua code with build‑user privileges. The risk is significant for organizations that perform local or CI pipeline packaging without isolation or prior validation of source archives.