The vulnerability exists in the oma package manager for AOSC OS, specifically in versions before 1.25.2. The oma-topics component fetches metadata called Topic Manifests from remote repository servers and registers them as APT source entries. The 'name' field in this metadata was not properly checked for transliteration, allowing a malicious actor to supply a malformed Topic Manifest. This can lead to the injection of malicious APT source entries into /etc/apt/sources.list.d/atm.list, potentially redirecting package management operations to attacker-controlled repositories. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences).

If exploited, this vulnerability could allow an attacker with the ability to supply malicious Topic Manifests to inject unauthorized APT source entries into the system's package manager configuration. This could lead to the system downloading and installing packages from untrusted or malicious repositories. The CVSS 4.0 base score is 5.2 (medium severity), reflecting network attack vector, high attack complexity, and required privileges and user interaction. There are no known exploits in the wild at this time.

This vulnerability is fixed in oma version 1.25.2. Users should upgrade to version 1.25.2 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated beyond the fix in 1.25.2, so users should verify with the vendor advisory for the latest guidance.