CVE-2022-39224: arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm
Summary
CVE-2022-39224: Impact Arbitrary shell execution is possible when using RPM::File#files and RPM::File#extract if the RPM contains a malicious "payload compressor" field. Affects arr-pm versions < 0.0.12. Fixed in 0.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
arr-pm is a RubyGems package that provides functionality for working with RPM files. It includes methods for extracting and listing files within an RPM package. However, versions of arr-pm prior to 0.0.12 are vulnerable to arbitrary shell execution when processing RPMs with a malicious "payload compressor" field. This vulnerability can be exploited to execute arbitrary commands on the system where arr-pm is being used.
Vulnerability Detail
The vulnerability in arr-pm arises from a lack of proper validation of the "payload compressor" field in RPM files. By crafting a malicious RPM with a specially crafted payload compressor value, an attacker can execute arbitrary shell commands during the extraction or listing of files using the extract and files methods of the RPM::File class. This can lead to unauthorized access, data manipulation, or even complete compromise of the system. The vulnerability has a CVSS score of 7.0, indicating a high severity level.
How To Fix
Latest published version: 0.0.12 as of 22 Oct 2026
gem install arr-pm -v 0.0.12The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update arr-pm to the fixed version, you can mitigate the risk by ensuring that any RPMs being processed with arr-pm contain valid and known payload compressor values. Valid values include gzip, bzip2, xz, zstd, and lzma. Before processing an RPM, you can check the payload compressor field using the rpm command line tool. For example:
% rpm -qp example-1.0-1.x86_64.rpm --qf "%{PAYLOADCOMPRESSOR}\n"
gzip
Conclusion
arr-pm versions prior to 0.0.12 are vulnerable to arbitrary shell execution when processing malicious RPMs. It is crucial to update arr-pm to version 0.0.12 or later to mitigate this vulnerability. If immediate updating is not possible, ensure that RPMs being processed have valid payload compressor values. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for arr-pm →
FAQ
arr-pm is a RubyGems package that provides functionality for working with RPM files. It allows users to extract and list files within an RPM package.
Versions of arr-pm prior to 0.0.12 are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting a malicious RPM with a specially crafted payload compressor value. When the RPM is processed using arr-pm's extract or files methods, arbitrary shell commands can be executed on the system.
The impact of this vulnerability includes potential unauthorized access, data manipulation, or complete compromise of the system where arr-pm is being used.
A workaround for this vulnerability is to ensure that any RPMs being processed with arr-pm contain valid and known payload compressor values. Valid values include gzip, bzip2, xz, zstd, and lzma.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
