An improper input validation vulnerability in befelemes pyp2spec allows a malicious PyPI package to execute arbitrary commands on the build machine when processed.

This is a code injection flaw caused by improper input validation, where unescaped RPM macro directives in package metadata are evaluated by rpmbuild with user interaction and local attack vector requirements.

A successful exploit allows an attacker to execute arbitrary commands on build machines, leading to potential compromise of the build pipeline, unauthorized access to sensitive build secrets, and integrity loss of generated RPM packages. While the CVSS score is 7.8, which places it in the high severity range, the local attack vector and required user interaction temper the urgency compared to network-based remote code execution vulnerabilities.

Immediate Action: Update befeleme pyp2spec to version 0.14.1 or later to ensure proper escaping of RPM macro directives.

Proactive Monitoring: Monitor build environments for unexpected child processes spawned by rpmbuild or anomalous resource utilization during package generation.

Compensating Controls: Restrict build environments to isolated, ephemeral containers with minimal privileges and strict network segmentation to limit the blast radius of potential code execution.

Public Exploit Available: No (no confirmed public exploit in available data)

Given the high severity rating and potential for complete system compromise on build infrastructure, administrators should apply the update to version 0.14.1 immediately. Securing the build pipeline is essential to prevent upstream supply chain injection attacks.