rpm macro-expands manifest entries before opening them, so a crafted manifest processed via rpm -q -p (or similar verify/manifest flows) can execute embedded shell commands as the rpm process (CWE-78). Affects Red Hat rpm on RHEL 7/8/9/10 and Red Hat Hardened Images. Mitigate by avoiding untrusted manifests; use –nomanifest and pre-validate entries to reject macro syntax.