CVE-2026-56004 CRITICAL

CVE-2026-56004: obs-service-tar_scm: command injection via mercurial handler

Vendor Opensuse

Product buildservice

Weakness CWE-78

Published July 2, 2026

Last update July 2, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Key dates

02Disclosure timeline

July 2, 2026 CVE published

July 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-56004 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html

Related vulnerabilities

04Related CVE

CVE-2026-55975 H.VIEW HV-500S6 IP Camera OS Command Injection CVE-2026-9862 Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability CVE-2026-46643 Snappy: Binary path is never shell-escaped due to an inverted is_executable check CVE-2026-11417 OS Command Injection in NodejsFunction Bundling in aws-cdk-lib CVE-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side