0day - Command execution - openSUSE OBS - CVE-2026-56004
Open Build Service, one year later: command execution through Mercurial argument injection
In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack surface and found a second, distinct flaw of the same family. It has now been reported to the openSUSE security team and fixed…
CVSS 10.0
0day - File read/write - openSUSE OBS - CVE-2024-22033
Supply Chain Attacks on Linux distributions - OpenSUSE Open Build Service
Open Build Service (OBS) is an open-source distribution development platform provided by openSUSE. It allows developers to manage the whole packaging process in order to build a package from a simple software source and…
CVSS 6.3