CVE-2026-56004

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Score

CVSS 3.1 10.0 Critical

Status

Awaiting Analysis - meissner@suse.de

Published

2026-07-02

Last modified

2026-10-25

Weaknesses

CWE-78

Affected products

• Buildservice (Opensuse)

References

• https://github.com/openSUSE/obs-service-tar_scm/pull/552/changes/bcf29d318c671c45fe87dd9f995a4a0c78ecedd7