An argument injection flaw in the RedHatInsights yggdrasil-worker-package-manager allows local authenticated users to achieve full system compromise.

The software suffers from improper neutralization of argument delimiters (CWE-88), which can be exploited by an authenticated local user to inject arbitrary command-line arguments. This results in the execution of unauthorized commands with the privileges of the worker process.

An attacker with local access can leverage this flaw to elevate privileges or execute malicious payloads on the host system. This represents a significant security risk to Red Hat Enterprise Linux 10 environments, as it allows for total technical impact, including unauthorized data access and potential system-wide disruption. The CVSS score of 7.8 reflects the high severity of allowing command injection in a privileged worker context.

Immediate Action: Update the yggdrasil-worker-package-manager to version 0.1.4 or 0.2.4 immediately.

Proactive Monitoring: Review system audit logs for unexpected process execution or abnormal command-line arguments initiated by the yggdrasil-worker user.

Compensating Controls: Restrict local user access to the specific systems running the vulnerable worker package manager until updates can be deployed.

Public Exploit Available: No

System administrators must prioritize this update, especially in multi-user environments where local privilege escalation is a concern. Applying the patch is the only reliable way to neutralize the argument injection risk.