CVE-2026-18157

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18157", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-28T20:03:33.510Z", "datePublished": "2026-07-31T02:38:28.243Z", "dateUpdated": "2026-11-04T22:10:32.074Z"}, "containers": {"cna": {"title": "Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability."}], "affected": [{"vendor": "RedHatInsights", "product": "yggdrasil-worker-package-manager", "versions": [{"status": "affected", "version": "0", "lessThan": "0.1.4", "versionType": "semver"}, {"status": "affected", "version": "0.2.0", "lessThan": "0.2.4", "versionType": "semver"}], "packageName": "yggdrasil-worker-package-manager", "collectionURL": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "yggdrasil-worker-package-manager", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-18157", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465250", "name": "RHBZ#2465250", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4"}], "datePublic": "2026-07-30T20:11:17.276Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-88: Improper Neutralization of Argument Delimiters in a Command", "timeline": [{"lang": "en", "time": "2026-05-04T14:54:08.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-30T20:11:17.276Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank AISLE Research for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T22:10:32.074Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T15:54:47.332670Z", "id": "CVE-2026-18157", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:58:53.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18157", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:54:47.332670Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:54:58.895Z"}}], "cna": {"title": "Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection", "credits": [{"lang": "en", "value": "Red Hat would like to thank AISLE Research for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "RedHatInsights", "product": "yggdrasil-worker-package-manager", "versions": [{"status": "affected", "version": "0", "lessThan": "0.1.4", "versionType": "semver"}, {"status": "affected", "version": "0.2.0", "lessThan": "0.2.4", "versionType": "semver"}], "packageName": "yggdrasil-worker-package-manager", "collectionURL": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "yggdrasil-worker-package-manager", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-04T14:54:08.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-30T20:11:17.276Z", "value": "Made public."}], "datePublic": "2026-07-30T20:11:17.276Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-18157", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465250", "name": "RHBZ#2465250", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4"}, {"url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T22:10:32.074Z"}, "x_redhatCweChain": "CWE-88: Improper Neutralization of Argument Delimiters in a Command"}}, "cveMetadata": {"cveId": "CVE-2026-18157", "state": "PUBLISHED", "dateUpdated": "2026-11-04T22:10:32.074Z", "dateReserved": "2026-07-28T20:03:33.510Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-07-31T02:38:28.243Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager", "defaultStatus": "unaffected", "packageName": "yggdrasil-worker-package-manager", "product": "yggdrasil-worker-package-manager", "vendor": "RedHatInsights", "versions": [{"lessThan": "0.1.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "0.2.4", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "yggdrasil-worker-package-manager", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en yggdrasil-worker-package-manager. Un atacante local con acceso existente al sistema podr\u00eda explotar una vulnerabilidad de inyecci\u00f3n de argumentos en el backend de APT. Esto permite que nombres de paquetes especialmente dise\u00f1ados, que comienzan con un guion, sean malinterpretados como opciones de comando por apt-get. La explotaci\u00f3n exitosa podr\u00eda conducir a ejecuci\u00f3n remota de c\u00f3digo (RCE) con privilegios de root, permitiendo al atacante comprometer completamente la integridad, confidencialidad y disponibilidad del sistema."}], "id": "CVE-2026-18157", "lastModified": "2026-11-04T22:18:02.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18157", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T15:54:47.332670Z", "version": "2.0.3"}}]}, "published": "2026-07-31T03:16:25.223", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-18157"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465250"}, {"source": "secalert@redhat.com", "url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7"}, {"source": "secalert@redhat.com", "url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4"}, {"source": "secalert@redhat.com", "url": "https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank AISLE Research for reporting this issue.", "bugzilla": {"description": "yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: Remote Code Execution via APT Argument Injection", "id": "2465250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465250"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-88", "details": ["A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability."], "name": "CVE-2026-18157", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "yggdrasil-worker-package-manager", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-07-30T20:11:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18157\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18157\nhttps://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7"], "statement": "This flaw does not affect any Red Hat products as it only affects FreeBSD systems.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}]}, "product": "yggdrasil-worker-package-manager", "vendor": "redhatinsights"}], "created": "2026-07-31T19:15:18.673992+00:00", "updated": "2026-08-02T20:31:08.209204+00:00", "vendors": ["redhatinsights", "redhatinsights$PRODUCT$yggdrasil-worker-package-manager"]}