A command injection flaw exists in the Mercurial handler of the obs-service-tar_scm source service, allowing a crafted _service file to execute arbitrary shell commands in the context of the service user or a user performing a checkout. The weakness is classified as CWE‑78, granting attackers full code‑execution capability on the build host if the flaw is exploited. The vulnerability is limited to scenarios where the service processes a malicious _service file, meaning exploitation requires that an attacker can influence the content of that file or trigger its processing during a checkout.

Instances of the Open Build Service that use the tar_scm component prior to version 0.12.4 are affected. Any deployment that accepts and processes _service files describing Mercurial repositories is susceptible, as the component parses those files before performing checkout operations.

The CVSS score of 10 denotes a critical severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is the submission or alteration of a malicious _service file, which necessitates write access to that file or the ability to trigger its processing during a checkout. Based on the description, it is inferred that an attacker must be able to influence the handling of the _service file to achieve injection, limiting the practical attack surface relative to the severe potential impact.