Read the docs
TI-2026-10762 Aliases CVE-2026-12545GHSA-q4vv-h3wg-pwgx

Rubygem-hammer_cli: command injection via insecure editor invocation

Priority LOW 32CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Satellite 6.16 for RHEL 8—3.12.0-2.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—3.12.0-2.el9satPatch availableCNA
Red HatRed Hat Satellite 6.17 for RHEL 9—3.14.0-2.el9satPatch availableCNA
Red HatRed Hat Satellite 6.18 for RHEL 9—3.16.0-2.el9satPatch availableCNA
Red HatRed Hat Satellite 6.19 for RHEL 9—3.18.0-2.el9satPatch availableCNA
Red HatRed Hat Satellite 6——No fix listedCNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 3.12.0-2.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 3.12.0-2.el9sat Patch available CNA
  • Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0-2.el9sat Patch available CNA
  • Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 3.16.0-2.el9sat Patch available CNA
  • Red Hat Satellite 6.19 for RHEL 9 VendorRed Hat Affected — Fixed in 3.18.0-2.el9sat Patch available CNA
  • Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 16

CPEVersionsRoleVendor
cpe:/a:redhat:satellite:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_capsule:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_utils:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite:6.18::el96.18—Red Hat
  • cpe:/a:redhat:satellite:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:satellite_capsule:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_utils:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_capsule:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_utils:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite:66—Red Hat
  • cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2026:74506 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.16.14 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.23-1.el8sat, foreman-cli-3.12.0.23-1.el8sat, foreman-debug-3.12.0.23-1.el8sat +32
    • Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.23-1.el9sat, foreman-cli-3.12.0.23-1.el9sat, foreman-debug-3.12.0.23-1.el9sat +32
  • RHSA-2026:74505 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.17.12 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.22-1.el9sat, foreman-cli-3.14.0.22-1.el9sat, foreman-debug-3.14.0.22-1.el9sat +31
  • RHSA-2026:74504 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.18.10 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.25-1.el9sat, foreman-cli-3.16.0.25-1.el9sat, foreman-debug-3.16.0.25-1.el9sat +26
Show 1 more Red Hat advisories
  • RHSA-2026:74503 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.19.5 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 foreman-3.18.0.14-1.el9sat, foreman-cli-3.18.0.14-1.el9sat, foreman-debug-3.18.0.14-1.el9sat +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:74506
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:74506
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:74505
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:74504
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:74503
Not affected: 5 products
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12545
  2. 2026-10-03 Alias added: GHSA-q4vv-h3wg-pwgx

References

Advisory 4

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences