CRITICAL🇵🇱 Wersja polska

CVE-2026-56004

CVSS 10.0v3.1pub. 2026-07-02

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

🤖 AI Analysis
How it works

An attacker who is able to provide a malicious _service file to the Open Build Service system can place a specially crafted payload in it that exploits the vulnerable Mercurial handler. The tar_scm service during processing of such a file does not properly sanitize input data (CWE-78 — command injection), allowing shellcode injection. The malicious code is executed in the context of the source service process or a local user who checks out the service containing the malicious configuration.

Impact

An attacker can execute arbitrary code as a source service process or in the context of a local user processing a malicious _service file, which may lead to complete system takeover, data disclosure, and violation of data integrity and availability.

Mitigation & patch

Update obs-service-tar_scm to version 0.12.4 or later. Patch details are available in vendor references (pull request #552 in the openSUSE/obs-service-tar_scm repository).

Who is affected

obs-service-tar_scm before version 0.12.4 — affects Open Build Service instances using the Mercurial handler in the tar_scm service

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References