CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
A malicious topic manifest can inject CRLF characters into APT source entries, potentially allowing arbitrary code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-39958?
CVE-2026-39958 is a medium-severity vulnerability in AOSC-Dev oma, published on 9 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named "Topic Manifests" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.
Weakness: CWE-93
Which versions are affected by CVE-2026-39958?
How do I fix CVE-2026-39958?
No fix has been published for CVE-2026-39958 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39958 exists.
Sources
Also known as GHSA-86jc-7r6q-cr3f.