This vulnerability (CVE-2026-56004) involves OS command injection (CWE-78) in the mercurial handler component of the openSUSE buildservice's obs tar_scm source service. Specifically, versions prior to 0.12.4 allow an attacker who can provide a crafted _service file to inject shellcode, leading to arbitrary code execution with the privileges of the source service or the local user checking out the malicious service. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are provided, and the remediation level is not stated, so patch status is unknown.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system with the privileges of the source service or the local user performing the checkout. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is exploitable over the network with low complexity and no privileges required, though user interaction is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using versions of the obs tar_scm source service prior to 0.12.4 or restrict the ability to supply _service files to trusted users only.