CVE-2026-12545: Rubygem-hammer_cli: command injection via insecure editor invocation

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-07
Weakness: CWE-78

Description

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).

Affected products

Red Hat Satellite 6.16 for RHEL 8: all versions — fixed in 0:3.12.0-2.el8sat
Red Hat Satellite 6.16 for RHEL 9: all versions — fixed in 0:3.12.0-2.el9sat
Red Hat Satellite 6.17 for RHEL 9: all versions — fixed in 0:3.14.0-2.el9sat
Red Hat Satellite 6.18 for RHEL 9: all versions — fixed in 0:3.16.0-2.el9sat
Red Hat Satellite 6.19 for RHEL 9: all versions — fixed in 0:3.18.0-2.el9sat
Red Hat Satellite 6: all versions

How to fix

Upgrade to a fixed version: Red Hat Satellite 6.16 for RHEL 8 0:3.12.0-2.el8sat; Red Hat Satellite 6.16 for RHEL 9 0:3.12.0-2.el9sat; Red Hat Satellite 6.17 for RHEL 9 0:3.14.0-2.el9sat; Red Hat Satellite 6.18 for RHEL 9 0:3.16.0-2.el9sat; Red Hat Satellite 6.19 for RHEL 9 0:3.18.0-2.el9sat. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-12545 or the next vulnerability affects your stack