Critical severity10.0NVD Advisory· Published Jul 2, 2026· Updated Jul 2, 2026

CVE-2026-56004

Description

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Affected products

osv-coords
pkg:rpm/opensuse/obs-service-tar_scm&distro=openSUSE%20Tumbleweed
Range: < 0.12.4-1.1
OpenSUSE/obs-service-tar_scmllm-fuzzy
Range: <0.12.4

Patches

Vulnerability mechanics

References

github.com/openSUSE/obs-service-tar_scm/pull/552/changes/bcf29d318c671c45fe87dd9f995a4a0c78ecedd7nvd

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000