CVE-2026-39958

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39958
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39958.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39958
Aliases
  • GHSA-86jc-7r6q-cr3f
Published
2026-04-09T16:28:18.758Z
Modified
2026-07-08T08:13:55.124601638Z
Severity
  • 5.2 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
Details

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named "Topic Manifests" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39958.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-93"
    ]
}
References

Affected packages

Git / github.com/aosc-dev/oma

Affected ranges

Type
GIT
Repo
https://github.com/aosc-dev/oma
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b361c0f219bbf91a684610c76210f71f093dbc18
Fixed
0e3761bbba6a085c0a87c81aaeae481f395a3b0c
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.25.1"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha.10
0.1.0-alpha.11
0.1.0-alpha.12
0.1.0-alpha.3
0.1.0-alpha.5
0.1.0-alpha.6
0.1.0-alpha.7
0.1.0-alpha.8
0.1.0-alpha.9
0.13.1
apt-auth-config-v0.*
apt-auth-config-v0.1.0
apt-auth-config-v0.3.0
apt-auth-config-v0.4.0
apt-auth-config-v0.5.0
Other
echo
release-test
oma-console-v0.*
oma-console-v0.10.0
oma-console-v0.10.1
oma-console-v0.12.0
oma-console-v0.13.0
oma-console-v0.13.1
oma-console-v0.14.0
oma-console-v0.14.1
oma-console-v0.14.2
oma-console-v0.14.3
oma-console-v0.15.0
oma-console-v0.16.0
oma-console-v0.16.1
oma-console-v0.17.0
oma-console-v0.17.2
oma-console-v0.17.4
oma-console-v0.17.5
oma-console-v0.19.0
oma-console-v0.20.0
oma-console-v0.20.1
oma-console-v0.20.2
oma-console-v0.21.0
oma-console-v0.21.1
oma-console-v0.21.2
oma-console-v0.23.0
oma-console-v0.24.0
oma-console-v0.25.0
oma-console-v0.26.0
oma-console-v0.27.0
oma-console-v0.28.0
oma-console-v0.29.1
oma-console-v0.30.0
oma-console-v0.31.0
oma-console-v0.4.0
oma-console-v0.5.0
oma-console-v0.9.2
oma-contents-v0.*
oma-contents-v0.10.0
oma-contents-v0.10.1
oma-contents-v0.11.0
oma-contents-v0.13.0
oma-contents-v0.14.1
oma-contents-v0.14.2
oma-contents-v0.15.0
oma-contents-v0.16.0
oma-contents-v0.17.0
oma-contents-v0.17.1
oma-contents-v0.18.0
oma-contents-v0.19.0
oma-contents-v0.7.3
oma-contents-v0.7.4
oma-contents-v0.8.0
oma-contents-v0.9.0
oma-fetch-v0.*
oma-fetch-v0.10.0
oma-fetch-v0.10.1
oma-fetch-v0.10.2
oma-fetch-v0.10.3
oma-fetch-v0.11.0
oma-fetch-v0.12.0
oma-fetch-v0.13.0
oma-fetch-v0.14.0
oma-fetch-v0.15.0
oma-fetch-v0.15.1
oma-fetch-v0.16.0
oma-fetch-v0.17.0
oma-fetch-v0.17.1
oma-fetch-v0.17.2
oma-fetch-v0.19.0
oma-fetch-v0.20.0
oma-fetch-v0.22.0
oma-fetch-v0.23.0
oma-fetch-v0.24.0
oma-fetch-v0.25.0
oma-fetch-v0.26.0
oma-fetch-v0.26.1
oma-fetch-v0.27.0
oma-fetch-v0.28.0
oma-fetch-v0.29.0
oma-fetch-v0.3.6
oma-fetch-v0.30.0
oma-fetch-v0.31.0
oma-fetch-v0.32.1
oma-fetch-v0.34.0
oma-fetch-v0.35.0
oma-fetch-v0.36.1
oma-fetch-v0.36.2
oma-fetch-v0.4.0
oma-fetch-v0.4.1
oma-fetch-v0.49.1
oma-fetch-v0.5.0
oma-fetch-v0.8.1
oma-fetch-v0.8.3
oma-fetch-v0.8.6
oma-fetch-v0.9.0
oma-fetch-v0.9.1
oma-historty-v0.*
oma-historty-v0.4.10
oma-history-v0.*
oma-history-v0.3.0
oma-history-v0.4.2
oma-history-v0.4.3
oma-history-v0.4.4
oma-history-v0.4.5
oma-history-v0.4.6
oma-history-v0.4.7
oma-history-v0.4.8
oma-history-v0.4.9
oma-history-v0.5.0
oma-history-v0.6.0
oma-history-v0.6.1
oma-history-v0.7.0
oma-history-v0.8.0
oma-history-v0.9.0
oma-mirror-v0.*
oma-mirror-v0.1.0
oma-mirror-v0.2.0
oma-mirror-v0.3.0
oma-mirror-v0.4.0
oma-mirror-v0.5.1
oma-mirror-v0.7.0
oma-mirror-v0.8.0
oma-mirror-v0.8.1
oma-oma-pm-operation-type-v0.*
oma-oma-pm-operation-type-v0.3.0
oma-pm-operation-type-v0.*
oma-pm-operation-type-v0.1.5
oma-pm-operation-type-v0.10.1
oma-pm-operation-type-v0.2.0
oma-pm-operation-type-v0.4.0
oma-pm-operation-type-v0.5.0
oma-pm-operation-type-v0.6.0
oma-pm-operation-type-v0.6.1
oma-pm-operation-type-v0.7.0
oma-pm-operation-type-v0.8.0
oma-pm-operation-type-v0.9.0
oma-pm-operation-type-v0.9.2
oma-pm-v0.*
oma-pm-v0.15.11
oma-pm-v0.15.12
oma-pm-v0.15.13
oma-pm-v0.15.6
oma-pm-v0.15.7
oma-pm-v0.15.8
oma-pm-v0.18.10
oma-pm-v0.18.11
oma-pm-v0.18.12
oma-pm-v0.18.13
oma-pm-v0.18.9
oma-pm-v0.19.0
oma-pm-v0.20.0
oma-pm-v0.20.1
oma-pm-v0.21.0
oma-pm-v0.21.1
oma-pm-v0.22.0
oma-pm-v0.22.1
oma-pm-v0.23.0
oma-pm-v0.23.1
oma-pm-v0.23.2
oma-pm-v0.24.0
oma-pm-v0.24.4
oma-pm-v0.25.0
oma-pm-v0.26.0
oma-pm-v0.27.0
oma-pm-v0.27.1
oma-pm-v0.27.2
oma-pm-v0.28.0
oma-pm-v0.28.1
oma-pm-v0.28.2
oma-pm-v0.28.3
oma-pm-v0.29.0
oma-pm-v0.29.1
oma-pm-v0.29.2
oma-pm-v0.30.0
oma-pm-v0.31.0
oma-pm-v0.32.0
oma-pm-v0.33.0
oma-pm-v0.33.1
oma-pm-v0.33.2
oma-pm-v0.33.4
oma-pm-v0.33.5
oma-pm-v0.34.0
oma-pm-v0.35.0
oma-pm-v0.36.0
oma-pm-v0.36.1
oma-pm-v0.37.0
oma-pm-v0.37.2
oma-pm-v0.38.0
oma-pm-v0.38.1
oma-pm-v0.39.0
oma-pm-v0.40.0
oma-pm-v0.41.0
oma-pm-v0.41.1
oma-pm-v0.42.0
oma-pm-v0.42.3
oma-pm-v0.44.0
oma-pm-v0.45.0
oma-pm-v0.45.2
oma-pm-v0.45.3
oma-pm-v0.46.0
oma-pm-v0.48.0
oma-pm-v0.48.1
oma-pm-v0.48.2
oma-pm-v0.48.3
oma-pm-v0.48.4
oma-pm-v0.48.5
oma-pm-v0.49.0
oma-pm-v0.50.0
oma-pm-v0.52.0
oma-pm-v0.52.1
oma-pm-v0.53.0
oma-pm-v0.54.0
oma-pm-v0.55.0
oma-pm-v0.56.0
oma-pm-v0.56.1
oma-pm-v0.57.0
oma-pm-v0.59.1
oma-pm-v0.6.4
oma-pm-v0.60.1
oma-pm-v0.7.2
oma-pm-v0.8.0
oma-pm-v0.8.1
oma-pm-v0.8.2
oma-pm-v0.8.3
oma-pm-v0.8.4
oma-pm-v0.9.0
oma-pm-v0.9.1
oma-refreesh-v0.*
oma-refreesh-v0.35.1
oma-refresh-v0.*
oma-refresh-v0.12.1
oma-refresh-v0.12.10+sequoia-header-fix
oma-refresh-v0.12.11+sequoia-header-fix
oma-refresh-v0.12.12+sequoua-header-fi
oma-refresh-v0.12.13
oma-refresh-v0.12.4
oma-refresh-v0.12.5
oma-refresh-v0.12.6+sequoia-header-fix
oma-refresh-v0.12.9+sequoia-header-fix
oma-refresh-v0.13.0
oma-refresh-v0.13.1
oma-refresh-v0.13.2
oma-refresh-v0.14.0
oma-refresh-v0.14.1
oma-refresh-v0.14.2
oma-refresh-v0.15.0
oma-refresh-v0.15.1
oma-refresh-v0.15.2
oma-refresh-v0.16.0
oma-refresh-v0.16.1
oma-refresh-v0.16.2
oma-refresh-v0.16.3
oma-refresh-v0.16.4
oma-refresh-v0.16.5
oma-refresh-v0.17.0
oma-refresh-v0.18.0
oma-refresh-v0.18.1
oma-refresh-v0.18.2
oma-refresh-v0.18.3
oma-refresh-v0.19.0
oma-refresh-v0.20.0
oma-refresh-v0.20.1
oma-refresh-v0.20.2
oma-refresh-v0.20.3
oma-refresh-v0.20.4
oma-refresh-v0.21.0
oma-refresh-v0.22.0
oma-refresh-v0.22.1
oma-refresh-v0.22.2
oma-refresh-v0.23.0
oma-refresh-v0.23.1
oma-refresh-v0.24.0
oma-refresh-v0.24.1
oma-refresh-v0.25.0
oma-refresh-v0.26.0
oma-refresh-v0.26.1
oma-refresh-v0.26.2
oma-refresh-v0.26.5
oma-refresh-v0.27.0
oma-refresh-v0.28.0
oma-refresh-v0.29.0
oma-refresh-v0.30.0
oma-refresh-v0.31.0
oma-refresh-v0.32.0
oma-refresh-v0.32.1
oma-refresh-v0.34.0
oma-refresh-v0.35.0
oma-refresh-v0.35.2
oma-refresh-v0.35.3
oma-refresh-v0.35.5
oma-refresh-v0.35.6
oma-refresh-v0.37.0
oma-refresh-v0.37.1
oma-refresh-v0.37.2
oma-refresh-v0.38.0
oma-refresh-v0.38.2
oma-refresh-v0.38.3
oma-refresh-v0.39.0
oma-refresh-v0.39.1
oma-refresh-v0.39.2
oma-refresh-v0.39.3
oma-refresh-v0.41.0
oma-refresh-v0.42.0
oma-refresh-v0.42.1
oma-refresh-v0.42.2
oma-refresh-v0.44.0
oma-refresh-v0.45.0
oma-refresh-v0.46.0
oma-refresh-v0.46.1
oma-refresh-v0.47.0
oma-refresh-v0.48.0
oma-refresh-v0.48.1
oma-refresh-v0.48.2
oma-refresh-v0.48.3
oma-refresh-v0.48.4
oma-refresh-v0.48.6
oma-refresh-v0.49.0
oma-refresh-v0.49.1
oma-refresh-v0.50.0
oma-refresh-v0.51.2
oma-refresh-v0.53.1
oma-refresh-v0.54.4
oma-refresh-v0.54.5
oma-refresh-v0.54.6
oma-refresh-v0.6.10
oma-refresh-v0.6.5
oma-refresh-v0.6.6
oma-refresh-v0.6.7
oma-refresh-v0.6.9
oma-repo-verify-v0.*
oma-repo-verify-v0.1.0
oma-repo-verify-v0.1.1
oma-repo-verify-v0.10.0
oma-repo-verify-v0.2.0
oma-repo-verify-v0.3.0
oma-repo-verify-v0.4.0
oma-repo-verify-v0.6.0
oma-repo-verify-v0.6.1
oma-repo-verify-v0.8.0
oma-topics-v0.*
oma-topics-v0.10.0
oma-topics-v0.11.0
oma-topics-v0.11.1
oma-topics-v0.12.0
oma-topics-v0.13.0
oma-topics-v0.14.0
oma-topics-v0.14.1
oma-topics-v0.15.0
oma-topics-v0.16.0
oma-topics-v0.17.0
oma-topics-v0.18.0
oma-topics-v0.18.1
oma-topics-v0.18.2
oma-topics-v0.19.0
oma-topics-v0.20.0
oma-topics-v0.21.0
oma-topics-v0.22.0
oma-topics-v0.25.0
oma-topics-v0.26.0
oma-topics-v0.27.0
oma-topics-v0.3.2
oma-topics-v0.3.3
oma-topics-v0.7.1
oma-topics-v0.7.2
oma-topics-v0.9.0
oma-tum-v0.*
oma-tum-v0.1.0
oma-tum-v0.1.1
oma-tum-v0.2.0
oma-tum-v0.5.0
oma-tum-v0.5.2
oma-tum-v0.6.0
oma-tum-v0.6.1
oma-utils-v0.*
oma-utils-v0.1.8
oma-utils-v0.1.9
oma-utils-v0.10.0
oma-utils-v0.10.2
oma-utils-v0.10.3
oma-utils-v0.10.4
oma-utils-v0.10.5
oma-utils-v0.11.0
oma-utils-v0.11.1
oma-utils-v0.11.2
oma-utils-v0.12.0
oma-utils-v0.12.3
oma-utils-v0.13.0
oma-utils-v0.2.0
oma-utils-v0.6.2
oma-utils-v0.6.3
oma-utils-v0.6.4
oma-utils-v0.8.0
oma-utils-v0.8.1
oma-utils-v0.8.2
oma-utils-v0.8.3
oma-utils-v0.8.4
oma-utils-v0.8.5
oma-utils-v0.8.6
oma-utils-v0.8.8
oma-utils-v0.8.9
oma-utils-v0.9.1
oma-utils-v0.9.2
v0.*
v0.13.2
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.18.0
v0.18.1
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.24.2
v0.24.3
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.28.1
v0.28.2
v0.29.0
v0.29.1
v0.30.0
v0.30.1
v0.30.2
v0.30.3
v0.31.0
v0.31.1
v0.32.0
v0.32.1
v0.32.2
v0.33.0
v0.33.1
v0.34.0
v0.35.0
v0.36.0
v0.36.1
v0.36.2
v0.36.3
v0.37.0
v0.37.1
v0.38.0
v0.38.1
v0.38.2
v0.39.0
v0.40.0
v0.41.0
v0.41.1
v0.42.0
v0.43.0
v0.43.1
v0.43.2
v0.44.0
v0.44.1
v0.44.2
v0.45.0
v0.45.1
v0.45.2
v0.45.3
v0.45.4
v0.45.5
v0.45.6
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.1.0
v1.1.0-beta.7
v1.1.0-beta.8
v1.1.0-beta.9
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.10.0-rc1
v1.11.0-rc1
v1.12.0-rc.1
v1.13.0-rc.1
v1.14.514-rc.1
v1.15.0-rc.1
v1.16.0-rc.1
v1.16.0-rc.2
v1.17.0-rc.1
v1.17.0-rc.2
v1.17.0-rc.3
v1.17.0-rc.4
v1.18.0
v1.18.0-rc.1
v1.18.0-rc.2
v1.19.0-rc.1
v1.19.0-rc.2
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.20.0-rc.1
v1.21.0-rc.1
v1.22.0
v1.22.0-rc.1
v1.23.0-rc.1
v1.24.0-rc.1
v1.24.0-rc.2
v1.25.0
v1.25.0-rc.1
v1.25.0-rc.2
v1.25.0-rc.3
v1.25.1
v1.3.0
v1.3.1
v1.3.10
v1.3.11
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.19
v1.3.2
v1.3.20
v1.3.21
v1.3.22
v1.3.23
v1.3.24
v1.3.25
v1.3.26
v1.3.27
v1.3.28
v1.3.29
v1.3.3
v1.3.30
v1.3.31
v1.3.32
v1.3.33
v1.3.34
v1.3.35
v1.3.36
v1.3.37
v1.3.38
v1.3.39
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.3-with-deb-ci
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.8.0-rc.1
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39958.json"