OPEN BUILD SERVICE, ONE YEAR LATER: COMMAND EXECUTION THROUGH MERCURIAL ARGUMENT INJECTION

Summary from the TLDR InfoSec newsletter

Fenrisk found CVE-2026-56004 in Open Build Service's obs_scm Mercurial backend. An attacker-controlled _service revision beginning with --config could set a pre-update hook and run shell commands on the service server. A space in the value bypassed Python argparse handling of dash-prefixed arguments. Exploitation required Mercurial, a reachable HTTP(S) repository, and a successful clone. Fenrisk confirmed build.opensuse.org was vulnerable. openSUSE patched the flaw on July 2 by adding -- before the revision and recommending rejection of dash-prefixed revisions.