CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-18157
https://bugzilla.redhat.com/show_bug.cgi?id=2465250
https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7
https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4
https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en yggdrasil-worker-package-manager. Un atacante local con acceso existente al sistema podría explotar una vulnerabilidad de inyección de argumentos en el backend de APT. Esto permite que nombres de paquetes especialmente diseñados, que comienzan con un guion, sean malinterpretados como opciones de comando por apt-get. La explotación exitosa podría conducir a ejecución remota de código (RCE) con privilegios de root, permitiendo al atacante comprometer completamente la integridad, confidencialidad y disponibilidad del sistema.

Information

Published : 2026-07-31 03:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-18157

Mitre link : CVE-2026-18157

CVE.ORG link : CVE-2026-18157

JSON object : View

Products Affected

No product.

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-18157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18157", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:54:47.332670Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "RedHatInsights", "product": "yggdrasil-worker-package-manager", "versions": [{"status": "affected", "version": "0", "lessThan": "0.1.4", "versionType": "semver"}, {"status": "affected", "version": "0.2.0", "lessThan": "0.2.4", "versionType": "semver"}], "packageName": "yggdrasil-worker-package-manager", "collectionURL": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "yggdrasil-worker-package-manager", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-07-31T03:16:25.223", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-18157", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465250", "source": "secalert@redhat.com"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7", "source": "secalert@redhat.com"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4", "source": "secalert@redhat.com"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en yggdrasil-worker-package-manager. Un atacante local con acceso existente al sistema podr\u00eda explotar una vulnerabilidad de inyecci\u00f3n de argumentos en el backend de APT. Esto permite que nombres de paquetes especialmente dise\u00f1ados, que comienzan con un guion, sean malinterpretados como opciones de comando por apt-get. La explotaci\u00f3n exitosa podr\u00eda conducir a ejecuci\u00f3n remota de c\u00f3digo (RCE) con privilegios de root, permitiendo al atacante comprometer completamente la integridad, confidencialidad y disponibilidad del sistema."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "secalert@redhat.com"}