Merge pull request #1251 from jasnow/hammer_cli-adv

One new hammer_cli advisory

@simi - Thanks for reviewing and approving this PR.

Author: jasnow

gems/hammer_cli/CVE-2026-12545.yml

@@ -0,0 +1,35 @@
+---
+gem: hammer_cli
+cve: 2026-12545
+ghsa: q4vv-h3wg-pwgx
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-12545
+title: hammer_cli - Insecure interpolation of the $EDITOR environment variable
+date: 2026-10-01
+description: |
+  A flaw was found in rubygem-hammer_cli. A command injection vulnerability
+  exists in Hammer CLI and the Railties (Ruby on Rails) component
+  distributed with Satellite due to the insecure interpolation of the
+  $EDITOR environment variable into the Ruby system() method.
+  By passing a single interpolated string to system(), the application
+  invokes a system shell (/bin/sh) that interprets shell
+  metacharacters (e.g., ;, |, &).
+cvss_v3: 6.7
+patched_versions:
+  - "~> 3.19.1"
+  - ">= 5.0.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-12545
+    - https://rubygems.org/gems/hammer_cli/versions/5.0.1
+    - https://github.com/theforeman/hammer-cli/compare/5.0.0...5.0.1
+    - https://rubygems.org/gems/hammer_cli/versions/3.19.1
+    - https://github.com/theforeman/hammer-cli/compare/3.19.0...3.19.1
+    - https://github.com/theforeman/hammer-cli/pull/407/changes/9d602cd3cecd1e3711037fc4334c3c7d23dbd46b
+    - https://github.com/theforeman/hammer-cli/commit/a968f58aad9d79bfcd2b107c570f7dcabee033b6
+    - https://access.redhat.com/errata/RHSA-2026:74503
+    - https://access.redhat.com/security/cve/CVE-2026-12545
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2489993
+    - https://github.com/advisories/GHSA-q4vv-h3wg-pwgx
+notes: |
+  - cvss_v3 from GHSA and nvd-nist.gov URLs.
+  - date from GHSA URL