CVE Intelligence
Analysis AI-assisted

CVE-2026-39958: AOSC oma: APT source injection through malformed Topic Manifest

The oma package manager for AOSC OS, in versions before 1.25.2, does not check the name field of Topic Manifests that oma-topics fetches from remote mirrors. A malformed manifest can therefore lead to malicious APT source entries being written to atm.list. The issue is fixed in 1.25.2 and carries a CVSS 3.1 base score of 9.1, while no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39958 affects oma, the package manager for AOSC OS. According to the advisory, oma-topics fetches Topic Manifests for testing repositories from remote servers and registers them as APT source entries, but the name field of these manifests is not checked for transliteration before registration.

Impact

A malformed Topic Manifest may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list when oma-topics finishes fetching and registering metadata. The sources do not describe downstream effects in detail. Because APT source entries determine where packages are retrieved from, a malicious entry could direct package retrieval to untrusted repositories (inference).

Affected products and versions

  • Product: oma, the package manager for AOSC OS.
  • Affected versions: the description states versions prior to 1.25.2. The structured affected list in the record is empty, so no further version ranges are confirmed.
  • Fixed version: 1.25.2, as stated in the description and the v1.25.2 release page.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade oma to version 1.25.2 or later.
  • Review the security advisory GHSA-86jc-7r6q-cr3f and the fix commit.
  • Until the upgrade is done, limit topic retrieval to mirrors that your organization trusts.
  • After upgrading, review the entries in atm.list and remove any source lines you did not configure.

Detection guidance

  • Compare /etc/apt/sources.list.d/atm.list against the sources you expect, especially after oma-topics has run.
  • Watch for unexpected changes to files in the APT sources directory.
  • Check whether package sources point to hosts outside your approved mirror list.

Limitations of the available information

  • The record gives a CVSS 3.1 base score of 9.1 from the CNA, and a CVSS 4.0 score of 5.2 from GitHub. The sources do not explain the difference between them.
  • The affected and fixes lists are empty in the structured data. The version boundary comes from the description only.
  • The record does not describe the exact validation logic that is missing or the full range of possible effects.
  • The EPSS values in the record (probability 0.00644, percentile 0.49526) are provided without further context.

Frequently asked questions

Which versions are affected?

The description states that versions prior to 1.25.2 are affected. The structured affected list in the record is empty, so no other version ranges are confirmed.

Is this vulnerability being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade oma to 1.25.2 or later, then review the entries in atm.list and remove any source lines that were not configured intentionally.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.