Shellcode Injection Vulnerability in tar_scm Source Service by openSUSE
CVE-2026-56004

10CRITICAL

Key Information:

Vendor

Opensuse
Status
Buildservice
Vendor
CVE Published:
2 July 2026

What is CVE-2026-56004?

A vulnerability exists in the tar_scm source service prior to version 0.12.4 that allows shellcode injection via a specially crafted _service file. Attackers leveraging this weakness can execute arbitrary code as the source service or as the local user checking out affected services, posing significant security risks to systems using this service.

Affected Version(s)

buildservice 0 < 0.12.4

References

https://github.com/openSUSE/obs-service-tar_scm/pull/552/...
patch

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maxime Rinaudo of Fenrisk (www.fenrisk.com <http://www.fenrisk.com>)
.