Quick answers
- Is CVE-2026-56004 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56004 being exploited in the wild.
- How severe is CVE-2026-56004?
- High severity, with a CVSS score of 8.8, published 2 July 2026.
- Which products and versions are affected?
- Opensuse Obs-Service-Tar Scm before 0.12.4.
- Is there a fix for CVE-2026-56004?
- A patch was published on 2026-07-01: Fix merged in GitHub pull request 552 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-56004 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-56004?
- Check whether you run Opensuse Obs-Service-Tar Scm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability (CWE-78) exists in the Mercurial (hg) handler of the obs-service-tar_scm source service before version 0.12.4. The issue stems from improper sanitization of options such as 'revision' and 'url' within the Mercurial integration. An attacker can exploit this by providing a malicious `_service` file to a project. When the service is executed—either by the automated Open Build Service or by a local user checking out the service—the injected shell commands are executed with the privileges of the service or the local user. The vulnerability was addressed by improving option sanitization in the affected Python components.
Affected products
- openSUSE obs-service-tar_scm before 0.12.4
Timeline
- 2026-07-01: patched: Fix merged in GitHub pull request 552
- 2026-07-02: advisory: CVE-2026-56004 published by SUSE