CyberRota Analysis
AI-GeneratedA command injection vulnerability in rpmuncompress allows local attackers to execute arbitrary commands by exploiting improperly escaped shell metacharacters in specially crafted archive filenames. This flaw requires user interaction to trigger, posing a significant risk to the confidentiality, integrity, and availability of data for any user or automated process that invokes rpmuncompress on a malicious file. Organizations utilizing this tool should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.