CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)

[Ondrej Gajdusek <ogajduse () redhat com>]

Hi,

A security fix has been released in Hammer CLI, a command-line interface for
Foreman.

CVE-2026-12545: Hammer CLI: editor command injection

A local attacker who can influence Hammer CLI's editor configuration can cause
commands to execute when a user invokes the affected editor flow. If Hammer CLI
runs with elevated privileges, this can result in privilege escalation.

Affected versions: Hammer CLI 0.15.1 through 3.19.0, and 5.0.0
CVSS: 6.7 (Moderate)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Fixed versions: Hammer CLI 3.19.1 and 5.0.1
Credit: Guilherme Suckevicz

References:
- Foreman Security: https://theforeman.org/security.html#2026-12545
- Redmine: https://projects.theforeman.org/issues/39842
- Fix: https://github.com/theforeman/hammer-cli/pull/407

Thanks,
Ondrej Gajdusek
Foreman Release Team