https://seclists.org/oss-sec/2026/q4/64: CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)

Q: What conditions are required for exploitation?

The attacker must have local access, low-level privileges, and the ability to influence Hammer CLI's editor configuration. Exploitation also requires a user to invoke the affected editor flow.

Q: When should this issue be treated as a privilege-escalation risk?

Prioritize systems where Hammer CLI is run with elevated privileges. Under that condition, command execution through the manipulated editor configuration can lead to privilege escalation.

Q: Which releases should be updated?

Affected releases are 0.15.1 through 3.19.0, plus 5.0.0. Update to Hammer CLI 3.19.1 or 5.0.1, as appropriate for the deployed release line.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Hammer CLI>=0.15.1<=3.19.0, =5.0.0

Frequently Asked Questions

What conditions are required for exploitation?

The attacker must have local access, low-level privileges, and the ability to influence Hammer CLI's editor configuration. Exploitation also requires a user to invoke the affected editor flow.

When should this issue be treated as a privilege-escalation risk?

Prioritize systems where Hammer CLI is run with elevated privileges. Under that condition, command execution through the manipulated editor configuration can lead to privilege escalation.

Which releases should be updated?

Affected releases are 0.15.1 through 3.19.0, plus 5.0.0. Update to Hammer CLI 3.19.1 or 5.0.1, as appropriate for the deployed release line.