EUVD-2026-90968
GHSA-q4vv-h3wg-pwgx
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
A local authenticated user must control $EDITOR and trigger an editor action, giving AV:L/PR:L/UI:R with AC:H; command injection yields full host C/I/A with scope unchanged.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).
AnalysisAI
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already hold a valid local account on the Satellite host (PR:L) and be able to control the $EDITOR environment variable, then trigger a Hammer CLI operation that opens an external editor (UI:R) - that editor-launch code path interpolating $EDITOR into Ruby's system() is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, not top-tier, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat erratum RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503) to update the affected rubygem-hammer_cli and Satellite packages to the patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permi
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repositor
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logi
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today