A command injection flaw was found in the rpm package. When installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro, rpm executes an attacker‑controlled shell command via popen() during source file relocation. This flaw allows an attacker to run arbitrary commands as the invoking user, which is typically a non‑root account, by simply processing an untrusted .src.rpm. The weakness is a file‑path based command injection (CWE‑78).

The vulnerability affects Red Hat products including Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images. All affected systems that run the standard rpm implementation are potentially exposed if they process source RPMs from untrusted sources.

The CVSS score is 7.8 indicating high severity, while the EPSS score is not available, suggesting limited publicly observed exploitation data. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker who can supply or place a malicious .src.rpm on the target system can trigger the command injection by having rpm process that file. If the attacker can retrieve the resulting output, they may gain further foothold or compromise the service. The exploit requires only the ability to run rpm on the target system and does not demand elevated privileges prior to execution.