Is CVE-2026-56004 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-56004?

CVE-2026-56004 has a CVSS v3 severity of CRITICAL (10).

Back

CVE-2026-56004

Description

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services