CVE-2026-56004: A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as

criticalCVSS 10CVE-2026-56004

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 10
Published: 2026-07-02
Last updated: 2026-07-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56004

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-560040.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-56004	coverage & exploitation status	NVD · CVE.org

CVE-2026-56004: A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as

Details

Exploitation outlook

Referenced CVEs

More from NVD Recent CVEs