CVE-2026-56004 | Vulnetix

CVE-2026-56004 PUBLISHED CVSS 10 CRITICAL

Reported by suse · Published July 2, 2026

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Risk Scores

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
openSUSE	buildservice	0
openSUSE	buildservice	0

Timeline

Jul 2, 2026 CVE Published
Jul 2, 2026 CVE Updated
Jul 3, 2026 EPSS Score
Jul 4, 2026 Coalition ESS Score
Aug 7, 2026 EPSS Score

References

patch

Open in Interactive Console →