{"id":"CVE-2026-12545","published":"2026-10-01T18:17:15.700","lastModified":"2026-10-07T07:17:00.897","description":"A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).","cvssScore":6.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/5","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}