Opensuse - Buildservice - CRITICAL - CVE-2026-56004. A vulnerability exists in the tar_scm source service prior to version 0.12.4 that allows shellcode injection via a specially crafted _service file. Attackers leveraging this weakness can execute arbitrary code as the source service or as the local user checking out affected services, posing significant security risks to systems using this service.