Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-30T20:11:17 yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: Remote Code Execution via APT Argument Injection 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-88

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

Red Hat would like to thank AISLE Research for reporting this issue. Red Hat Enterprise Linux 10 Not affected yggdrasil-worker-package-manager https://www.cve.org/CVERecord?id=CVE-2026-18157 https://nvd.nist.gov/vuln/detail/CVE-2026-18157 https://github.com/RedHatInsights/yggdrasil-worker-package-manager/commit/959745bb5917c17f0316af199aace6c71baa5ad7 https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.1.4 https://github.com/RedHatInsights/yggdrasil-worker-package-manager/releases/tag/0.2.4