CVE-2026-56004 — obs-service-tar_scm: command injection via mercurial handler

CVE-2026-56004

obs-service-tar_scm: command injection via mercurial handler PUBLISHED

Description (CNA)

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Affected (CNA)

Vendor / product	Versions
openSUSE / buildservice	affected 0 before 0.12.4

CWE

CWE-78

References

https://github.com/openSUSE/obs-service-tar_scm/pull/552/changes/bcf29d318c671c45fe87dd9f995a4a0c78ecedd7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.