From 547470c745f0094b62c311aaacf8b0b642766467 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Fri, 2 Oct 2026 10:35:12 -0400
Subject: [PATCH 1/2] One new hammer_cli advisory

---
 gems/hammer_cli/CVE-2026-12545.yml | 35 ++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 gems/hammer_cli/CVE-2026-12545.yml

diff --git a/gems/hammer_cli/CVE-2026-12545.yml b/gems/hammer_cli/CVE-2026-12545.yml
new file mode 100644
index 0000000000..660ba58ac9
--- /dev/null
+++ b/gems/hammer_cli/CVE-2026-12545.yml
@@ -0,0 +1,35 @@
+---
+gem: hammer_cli
+cve: 2026-12545
+ghsa: q4vv-h3wg-pwgx
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-12545
+title: hammer_cli - Insecure interpolation of the $EDITOR environment variable
+date: 2026-10-02
+description: |
+  A flaw was found in rubygem-hammer_cli. A command injection vulnerability
+  exists in Hammer CLI and the Railties (Ruby on Rails) component
+  distributed with Satellite due to the insecure interpolation of the
+  $EDITOR environment variable into the Ruby system() method.
+  By passing a single interpolated string to system(), the application
+  invokes a system shell (/bin/sh) that interprets shell
+  metacharacters (e.g., ;, |, &).
+cvss_v3: 6.7
+patched_versions:
+  - "~> 3.19.1"
+  - ">= 5.0.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-12545
+    - https://rubygems.org/gems/hammer_cli/versions/5.0.1
+    - https://github.com/theforeman/hammer-cli/compare/5.0.0...5.0.1
+    - https://rubygems.org/gems/hammer_cli/versions/3.19.1
+    - https://github.com/theforeman/hammer-cli/compare/3.19.0...3.19.1
+    - https://github.com/theforeman/hammer-cli/pull/407/changes/9d602cd3cecd1e3711037fc4334c3c7d23dbd46b
+    - https://github.com/theforeman/hammer-cli/commit/a968f58aad9d79bfcd2b107c570f7dcabee033b6
+    - https://access.redhat.com/errata/RHSA-2026:74503
+    - https://access.redhat.com/security/cve/CVE-2026-12545
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2489993
+    - https://github.com/advisories/GHSA-q4vv-h3wg-pwgx
+notes: |
+  - cvss_v3 from GHSA and nvd-nist.gov URLs.
+  - date from rubygems.org URL

From 188730e68e626175b82c8af43ca30b26e7a447bf Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:13:10 -0400
Subject: [PATCH 2/2] Fix date and notes in CVE-2026-12545.yml

Updated the date field in CVE-2026-12545.yml from '2026-10-02' to '2026-10-01' and modified notes regarding the date source.
---
 gems/hammer_cli/CVE-2026-12545.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gems/hammer_cli/CVE-2026-12545.yml b/gems/hammer_cli/CVE-2026-12545.yml
index 660ba58ac9..7720e5b2a1 100644
--- a/gems/hammer_cli/CVE-2026-12545.yml
+++ b/gems/hammer_cli/CVE-2026-12545.yml
@@ -4,7 +4,7 @@ cve: 2026-12545
 ghsa: q4vv-h3wg-pwgx
 url: https://nvd.nist.gov/vuln/detail/CVE-2026-12545
 title: hammer_cli - Insecure interpolation of the $EDITOR environment variable
-date: 2026-10-02
+date: 2026-10-01
 description: |
   A flaw was found in rubygem-hammer_cli. A command injection vulnerability
   exists in Hammer CLI and the Railties (Ruby on Rails) component
@@ -32,4 +32,4 @@ related:
     - https://github.com/advisories/GHSA-q4vv-h3wg-pwgx
 notes: |
   - cvss_v3 from GHSA and nvd-nist.gov URLs.
-  - date from rubygems.org URL
+  - date from GHSA URL