CVE-2026-12545 Ruby — Exploit & Vulnerability Details MEDIUM

Parameter	Value
CVSS	6.7 (MEDIUM)
Type	CWE-78 (OS Command Injection)
Vendor	Ruby
Public PoC	No

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).

Attack Parameters

Attack Vector

Local

Requires local access

Attack Complexity

High

Difficult to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

Required

User action required

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-78 OS Command Injection

Vulnerable Products

red hat:red hat satellite 6.18 for rhel 9 red hat:red hat satellite 6.16 for rhel 8 red hat:red hat satellite 6.19 for rhel 9 red hat:red hat satellite 6.16 for rhel 9 red hat:red hat satellite 6