Is CVE-2026-42301 actively exploited?

No active exploitation of CVE-2026-42301 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42301 be exploited remotely?

No. CVE-2026-42301 requires local access to exploit.

What is the CVSS score of CVE-2026-42301?

CVE-2026-42301 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-42301

HIGH

CVE-2026-42301

CWE-20Published: May 9, 2026· Updated: May 13, 2026

7.8

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.3th

Official Description

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.

NVD Source

Technical Analysis

CVE-2026-42301 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.