CVE-2026-84233Disclosure

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR46d
Disclosure
🚨High - rpm rpmuncompress Macro Expansion Command Injection (CVE-2026-84233) rpm's rpmuncompress -x builds its command line from the input filename; a crafted .gem name containing RPM macro syntax triggers macro expansion during command construction, leading to arbitrary command execution as the invoking user. Systems not invoking rpmuncompress on untrusted filenames are not impacted. 👉Affected: rpm (versions unknown)
Post summary
The tweet discloses CVE-2026-84233, a command injection flaw in rpm's rpmuncompress that allows arbitrary command execution through crafted filenames, with no PoC, exploit, or patch details provided.
0000090
296 followersView on X

Explore more

Back to dashboard