Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-09 | 2 | Disclosure2 |
| 2026-05-11 | 1 | Disclosure1 |
⚡ New CVE Alert: CVE-2026-42301 📊 Severity: 7.8 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42301 #CVE-2026-42301 #CVE #High #CyberSecurity #InfoSec https://t.co/RDj0U6f3M9
Post summary
A brief CVE alert for CVE-2026-42301 that provides its severity rating, a high risk level, and a link to the NVD entry, with no additional technical or exploit details.
CVE-2026-42301 pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into… https://www.cve.org/CVERecord?id=CVE-2026-42301
Post summary
This text discloses an issue with pyp2spec where, before version 0.14.1, it incorrectly wrote PyPI package metadata into the generated Fedora RPM spec file.
CVE-2026-42301 Arbitrary Command Execution in pyp2spec via Unescaped RPM Macro D... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42301 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
Tweet announces CVE-2026-42301 as an arbitrary command execution vulnerability in pyp2spec via unescaped RPM macro, providing only a headline and link to details, with no PoC, exploit, or patch information.