by Kastro
Paper/Archive/CVE-2026-56004

CVE-2026-56004

openSUSE buildservice — obs-service-tar_scm: command injection via mercurial handler

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 51.6.516 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Affected

ProductAffectedFixed inSource
buildservice< 0.12.40.12.4CNA

Scores by source

suse (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/openSUSE/obs-service-tar_scm/pull/552/changes/bcf29d318c671c45fe87dd9f995a4a0c78ecedd7