---
id: CVE-2026-42301
title: >-
  pyp2spec: pyp2spec: Arbitrary command execution via unescaped RPM macro
  directives (CVE-2026-42301)
summary: >-
  A flaw was found in pyp2spec, a tool that generates Fedora RPM spec files for
  Python projects. This vulnerability allows a malicious Python Package Index
  (PyPI) package to execute arbitrary commands on a build machine. This occurs
  because …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: vendor
vendor: Red Hat
product: pyp2spec
affected:
  - pyp2spec < 0.14.1
patched:
  - pyp2spec 0.14.1
published: '2026-05-09'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:02:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42301.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42301.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42301'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42301'
  - url: >-
      https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42301'
  - url: 'https://github.com/befeleme/pyp2spec'
  - url: 'https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00198
epssPercentile: 0.09849
aliases:
  - GHSA-r35x-v8p8-xvhw
  - PYSEC-2026-3003
ecosystem: pip
scores:
  vendor: 7.3
  osv: 7.8
ingestedAt: '2026-07-13T18:58:02.365Z'
---

## Overview

A flaw was found in pyp2spec, a tool that generates Fedora RPM spec files for Python projects. This vulnerability allows a malicious Python Package Index (PyPI) package to execute arbitrary commands on a build machine. This occurs because pyp2spec writes PyPI package metadata, such as the summary field, into the generated spec file without properly escaping RPM macro directives. When a packager subsequently runs rpmbuild, these unescaped directives are evaluated, leading to the execution of arbitrary commands.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42301.json)

**pyp2spec: pyp2spec: Arbitrary command execution via unescaped RPM macro directives**. Released 2026-05-09, updated 2026-09-18.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.

## Package advisory (CVE-2026-42301)

Affected packages:

- `pyp2spec < 0.14.1`

Patched in:

- `pyp2spec 0.14.1`

Source: https://osv.dev/vulnerability/GHSA-r35x-v8p8-xvhw