{"id":"CVE-2026-39958","summary":"oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection","details":"oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named \"Topic Manifests\" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.","aliases":["GHSA-86jc-7r6q-cr3f"],"modified":"2026-07-08T08:13:55.124601638Z","published":"2026-04-09T16:28:18.758Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-93"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39958.json"},"references":[{"type":"WEB","url":"https://github.com/AOSC-Dev/oma/releases/tag/v1.25.2"},{"type":"ADVISORY","url":"https://github.com/AOSC-Dev/oma/security/advisories/GHSA-86jc-7r6q-cr3f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39958.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39958"},{"type":"FIX","url":"https://github.com/AOSC-Dev/oma/commit/b361c0f219bbf91a684610c76210f71f093dbc18"},{"type":"FIX","url":"https://github.com/AOSC-Dev/oma/pull/733"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aosc-dev/oma","events":[{"introduced":"0"},{"fixed":"b361c0f219bbf91a684610c76210f71f093dbc18"},{"fixed":"0e3761bbba6a085c0a87c81aaeae481f395a3b0c"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.25.1"}]}}],"versions":["oma-topics-v0.27.0","oma-refresh-v0.54.6","oma-refresh-v0.54.5","v1.25.1","oma-refresh-v0.54.4","v1.25.0","v1.25.0-rc.3","oma-fetch-v0.36.2","v1.25.0-rc.2","v1.25.0-rc.1","oma-tum-v0.6.1","oma-mirror-v0.8.1","oma-fetch-v0.36.1","oma-contents-v0.19.0","oma-console-v0.31.0","v1.24.0-rc.2","v1.24.0-rc.1","oma-utils-v0.13.0","oma-tum-v0.6.0","oma-topics-v0.26.0","oma-repo-verify-v0.10.0","oma-refresh-v0.53.1","oma-pm-v0.60.1","oma-pm-operation-type-v0.10.1","oma-mirror-v0.8.0","oma-history-v0.9.0","oma-fetch-v0.35.0","oma-contents-v0.18.0","oma-console-v0.30.0","echo","apt-auth-config-v0.5.0","v1.23.0-rc.1","oma-utils-v0.12.3","oma-tum-v0.5.2","oma-refresh-v0.51.2","oma-pm-v0.59.1","v1.22.0","v1.22.0-rc.1","oma-tum-v0.5.0","oma-refresh-v0.50.0","oma-pm-v0.57.0","oma-fetch-v0.34.0","oma-console-v0.29.1","oma-fetch-v0.32.1","v1.21.0-rc.1","oma-refresh-v0.49.1","oma-pm-v0.56.1","oma-fetch-v0.49.1","oma-utils-v0.12.0","oma-refresh-v0.49.0","oma-pm-v0.56.0","oma-pm-operation-type-v0.9.2","v1.20.0-rc.1","oma-tum-v0.2.0","oma-topics-v0.25.0","oma-refresh-v0.48.6","oma-pm-v0.55.0","oma-mirror-v0.7.0","oma-history-v0.8.0","v1.19.0-rc.2","oma-refresh-v0.48.4","oma-pm-v0.54.0","v1.19.0-rc.1","oma-tum-v0.1.1","oma-tum-v0.1.0","v1.18.0","v1.18.0-rc.2","v1.18.0-rc.1","oma-refresh-v0.48.3","oma-pm-v0.53.0","oma-history-v0.7.0","oma-fetch-v0.31.0","oma-refresh-v0.48.2","oma-refresh-v0.48.1","oma-refresh-v0.48.0","oma-mirror-v0.5.1","v1.17.0-rc.3","oma-refresh-v0.47.0","oma-refresh-v0.46.1","oma-pm-v0.52.1","oma-fetch-v0.30.0","oma-repo-verify-v0.8.0","oma-refresh-v0.46.0","v1.17.0-rc.4","oma-refresh-v0.45.0","v1.17.0-rc.2","v1.17.0-rc.1","oma-utils-v0.11.2","oma-refresh-v0.44.0","oma-pm-v0.52.0","oma-fetch-v0.29.0","oma-console-v0.28.0","oma-pm-v0.50.0","v1.16.0-rc.2","v1.16.0-rc.1","oma-pm-v0.49.0","oma-history-v0.6.1","oma-contents-v0.17.1","oma-refresh-v0.42.2","oma-pm-v0.48.5","oma-fetch-v0.28.0","v1.15.0-rc.1","oma-pm-v0.48.4","oma-utils-v0.11.1","oma-repo-verify-v0.6.1","oma-refresh-v0.42.1","oma-pm-v0.48.3","oma-fetch-v0.27.0","oma-pm-v0.48.2","oma-pm-v0.48.1","oma-fetch-v0.26.1","oma-utils-v0.11.0","oma-topics-v0.22.0","oma-repo-verify-v0.6.0","oma-refresh-v0.42.0","oma-pm-v0.48.0","oma-pm-operation-type-v0.9.0","oma-mirror-v0.4.0","oma-history-v0.6.0","oma-fetch-v0.26.0","oma-contents-v0.17.0","oma-console-v0.27.0","apt-auth-config-v0.4.0","v1.14.514-rc.1","oma-utils-v0.10.5","oma-topics-v0.21.0","oma-refresh-v0.41.0","oma-pm-v0.46.0","oma-pm-operation-type-v0.8.0","oma-mirror-v0.3.0","oma-history-v0.5.0","oma-fetch-v0.25.0","oma-console-v0.26.0","apt-auth-config-v0.3.0","oma-contents-v0.16.0","oma-refresh-v0.39.3","oma-pm-v0.45.3","oma-fetch-v0.24.0","oma-repo-verify-v0.4.0","oma-refresh-v0.39.2","oma-pm-v0.45.2","oma-refresh-v0.39.1","oma-fetch-v0.23.0","oma-refresh-v0.39.0","oma-refresh-v0.38.3","v1.13.0-rc.1","oma-refresh-v0.38.2","oma-topics-v0.20.0","oma-repo-verify-v0.3.0","oma-refresh-v0.38.0","oma-pm-v0.45.0","oma-fetch-v0.22.0","oma-contents-v0.15.0","oma-refresh-v0.37.2","oma-topics-v0.19.0","oma-refresh-v0.37.1","oma-utils-v0.10.4","oma-repo-verify-v0.2.0","oma-refresh-v0.37.0","oma-pm-v0.44.0","oma-console-v0.25.0","oma-utils-v0.10.3","oma-refresh-v0.35.6","oma-pm-v0.24.4","oma-fetch-v0.20.0","oma-console-v0.24.0","oma-utils-v0.10.2","oma-refresh-v0.35.5","oma-pm-v0.42.3","oma-fetch-v0.19.0","oma-console-v0.23.0","oma-console-v0.21.2","oma-utils-v0.10.0","oma-refresh-v0.35.3","oma-pm-v0.42.0","oma-pm-operation-type-v0.7.0","oma-historty-v0.4.10","oma-contents-v0.14.2","oma-refresh-v0.35.2","oma-pm-v0.41.1","oma-topics-v0.18.2","oma-mirror-v0.2.0","oma-refreesh-v0.35.1","oma-pm-operation-type-v0.6.1","oma-fetch-v0.17.2","oma-pm-v0.41.0","oma-pm-v0.40.0","oma-topics-v0.18.1","oma-pm-v0.39.0","oma-pm-operation-type-v0.6.0","oma-history-v0.4.9","oma-utils-v0.9.2","oma-topics-v0.18.0","oma-repo-verify-v0.1.1","oma-refresh-v0.35.0","oma-history-v0.4.8","oma-fetch-v0.17.1","oma-contents-v0.14.1","oma-console-v0.21.1","oma-pm-v0.38.1","oma-utils-v0.9.1","oma-refresh-v0.34.0","oma-pm-v0.38.0","oma-fetch-v0.17.0","oma-console-v0.21.0","apt-auth-config-v0.1.0","oma-console-v0.20.2","oma-console-v0.20.1","oma-utils-v0.8.9","oma-pm-v0.37.2","oma-console-v0.20.0","oma-pm-v0.37.0","oma-pm-operation-type-v0.5.0","oma-history-v0.4.7","v1.12.0-rc.1","oma-refresh-v0.32.1","oma-mirror-v0.1.0","oma-utils-v0.8.8","oma-pm-v0.36.1","oma-console-v0.19.0","oma-topics-v0.17.0","oma-refresh-v0.32.0","oma-pm-v0.36.0","oma-topics-v0.16.0","oma-refresh-v0.31.0","oma-pm-v0.35.0","oma-fetch-v0.16.0","oma-refresh-v0.30.0","oma-fetch-v0.15.1","oma-topics-v0.15.0","oma-refresh-v0.29.0","oma-pm-v0.34.0","oma-history-v0.4.6","oma-fetch-v0.15.0","oma-console-v0.17.5","oma-pm-v0.33.5","oma-pm-v0.33.4","v1.11.0-rc1","oma-refresh-v0.28.0","oma-console-v0.17.4","oma-console-v0.17.2","oma-refresh-v0.27.0","v1.10.0-rc1","oma-utils-v0.8.6","oma-pm-v0.33.2","oma-contents-v0.13.0","oma-console-v0.17.0","oma-console-v0.16.1","oma-utils-v0.8.5","oma-pm-v0.33.1","oma-console-v0.16.0","oma-pm-v0.33.0","oma-pm-v0.32.0","oma-pm-v0.31.0","oma-history-v0.4.5","oma-pm-operation-type-v0.4.0","oma-refresh-v0.26.5","oma-fetch-v0.14.0","oma-refresh-v0.26.2","oma-refresh-v0.26.1","oma-contents-v0.11.0","v1.9.0-rc1","oma-refresh-v0.26.0","oma-pm-v0.30.0","oma-oma-pm-operation-type-v0.3.0","oma-history-v0.4.4","oma-refresh-v0.25.0","oma-utils-v0.8.4","oma-pm-v0.29.2","oma-console-v0.15.0","v1.8.0-rc.1","oma-refresh-v0.24.1","oma-pm-v0.29.1","oma-contents-v0.10.1","oma-pm-v0.29.0","oma-contents-v0.10.0","v1.7.1","v1.7.0","oma-contents-v0.9.0","oma-console-v0.14.3","oma-refresh-v0.24.0","oma-pm-v0.28.3","oma-fetch-v0.13.0","oma-contents-v0.8.0","v1.6.0","oma-console-v0.14.2","oma-console-v0.14.1","oma-utils-v0.8.3","oma-pm-v0.28.2","oma-console-v0.14.0","oma-console-v0.13.1","oma-pm-v0.28.1","oma-pm-v0.28.0","oma-utils-v0.8.2","oma-pm-v0.27.2","oma-console-v0.13.0","v1.5.2","oma-topics-v0.14.1","v1.5.1","v1.5.0","oma-utils-v0.8.1","oma-topics-v0.14.0","oma-refresh-v0.23.1","oma-pm-v0.27.1","oma-console-v0.12.0","oma-topics-v0.13.0","oma-refresh-v0.23.0","oma-repo-verify-v0.1.0","v1.4.3-with-deb-ci","v1.4.3","oma-pm-v0.27.0","v1.4.2","oma-refresh-v0.22.2","oma-topics-v0.12.0","oma-refresh-v0.22.1","v1.4.1","oma-topics-v0.11.1","v1.4.0","oma-refresh-v0.22.0","oma-topics-v0.11.0","oma-refresh-v0.21.0","v1.3.39","oma-pm-v0.26.0","v1.3.38","v1.3.37","v1.3.36","oma-pm-v0.25.0","oma-topics-v0.10.0","oma-refresh-v0.20.4","v1.3.35","oma-refresh-v0.20.3","v1.3.34","oma-topics-v0.9.0","oma-refresh-v0.20.2","v1.3.33","oma-refresh-v0.20.1","oma-refresh-v0.20.0","oma-pm-v0.24.0","oma-pm-operation-type-v0.2.0","oma-history-v0.4.3","oma-fetch-v0.12.0","v1.3.32","oma-refresh-v0.19.0","v1.3.31","oma-refresh-v0.18.3","oma-pm-v0.23.2","v1.3.30","oma-pm-v0.23.1","oma-contents-v0.7.4","v1.3.29","oma-pm-v0.23.0","v1.3.28","oma-refresh-v0.18.2","v1.3.27","oma-refresh-v0.18.1","v1.3.26","oma-pm-v0.22.1","oma-pm-v0.22.0","oma-refresh-v0.18.0","v1.3.25","oma-refresh-v0.17.0","oma-pm-v0.21.1","oma-fetch-v0.11.0","v1.3.24","oma-refresh-v0.16.5","oma-refresh-v0.16.4","v1.3.23","v1.3.22","oma-pm-v0.21.0","v1.3.21","oma-fetch-v0.10.3","v1.3.20","oma-utils-v0.8.0","oma-refresh-v0.16.3","oma-pm-v0.20.1","oma-pm-operation-type-v0.1.5","v1.3.19","oma-refresh-v0.16.2","oma-fetch-v0.10.2","v1.3.18","oma-refresh-v0.16.1","oma-fetch-v0.10.1","oma-refresh-v0.16.0","oma-contents-v0.7.3","v1.3.17","oma-refresh-v0.15.2","v1.3.16","oma-refresh-v0.15.1","oma-pm-v0.20.0","v1.3.15","oma-refresh-v0.15.0","v1.3.14","oma-refresh-v0.14.2","v1.3.13","oma-refresh-v0.14.1","v1.3.12","oma-pm-v0.19.0","oma-refresh-v0.14.0","oma-pm-v0.18.13","oma-fetch-v0.10.0","oma-pm-v0.18.12","v1.3.11","release-test","v1.3.10","oma-refresh-v0.13.2","oma-refresh-v0.13.1","v1.3.9","v1.3.8","v1.3.7","v1.3.6","oma-refresh-v0.13.0","oma-pm-v0.18.11","oma-refresh-v0.12.13","v1.3.5","oma-refresh-v0.12.12+sequoua-header-fi","oma-fetch-v0.9.1","v1.3.4","oma-refresh-v0.12.11+sequoia-header-fix","oma-pm-v0.18.10","oma-fetch-v0.9.0","v1.3.3","oma-refresh-v0.12.10+sequoia-header-fix","oma-fetch-v0.8.6","v1.3.2","oma-history-v0.4.2","oma-refresh-v0.12.9+sequoia-header-fix","v1.3.1","oma-pm-v0.18.9","v1.3.0","v1.2.24","oma-console-v0.10.1","v1.2.23","oma-refresh-v0.12.6+sequoia-header-fix","v1.2.22","v1.2.21","oma-utils-v0.6.4","v1.2.20","oma-pm-v0.15.13","v1.2.19","oma-utils-v0.6.3","oma-pm-v0.15.12","oma-console-v0.10.0","v1.2.18","oma-pm-v0.15.11","v1.2.17","oma-console-v0.9.2","v1.2.16","oma-utils-v0.6.2","v1.2.15","v1.2.14","oma-refresh-v0.12.5","v1.2.13","oma-topics-v0.7.2","oma-refresh-v0.12.4","oma-fetch-v0.8.3","v1.2.12","v1.2.11","v1.2.10","v1.2.9","oma-topics-v0.7.1","oma-pm-v0.15.8","v1.2.8","oma-pm-v0.15.7","v1.2.7","v1.2.6","oma-pm-v0.15.6","v1.2.5","oma-refresh-v0.12.1","oma-fetch-v0.8.1","v1.2.4","v1.2.3","v1.2.2","v1.2.1","oma-history-v0.3.0","v1.2.0","v1.1.8","oma-pm-v0.9.1","v1.1.7","v1.1.6","oma-pm-v0.9.0","v1.1.5","v1.1.4","v1.1.3","v1.1.2","oma-refresh-v0.6.10","v1.1.1","oma-utils-v0.2.0","oma-refresh-v0.6.9","oma-pm-v0.8.4","v1.1.0","oma-refresh-v0.6.7","oma-pm-v0.8.3","oma-fetch-v0.5.0","oma-utils-v0.1.9","oma-topics-v0.3.3","oma-refresh-v0.6.6","oma-pm-v0.8.2","oma-fetch-v0.4.1","oma-console-v0.5.0","oma-refresh-v0.6.5","oma-pm-v0.8.1","oma-fetch-v0.4.0","v1.1.0-beta.9","v1.1.0-beta.8","oma-utils-v0.1.8","oma-topics-v0.3.2","oma-pm-v0.8.0","oma-pm-v0.6.4","oma-fetch-v0.3.6","oma-console-v0.4.0","v1.1.0-beta.7","oma-pm-v0.7.2","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.45.6","v0.45.5","v0.45.4","v0.45.3","v0.45.2","v0.45.1","v0.45.0","v0.44.2","v0.44.1","v0.44.0","v0.43.2","v0.43.1","v0.43.0","v0.42.0","v0.41.1","v0.41.0","v0.40.0","v0.39.0","v0.38.2","v0.38.1","v0.38.0","v0.37.1","v0.37.0","v0.36.3","v0.36.2","v0.36.1","v0.36.0","v0.35.0","v0.34.0","v0.33.1","v0.33.0","v0.32.2","v0.32.1","v0.32.0","v0.31.1","v0.31.0","v0.30.3","v0.30.2","v0.30.1","v0.30.0","v0.29.1","v0.29.0","v0.28.2","v0.28.1","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.3","v0.24.2","v0.24.1","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.1","v0.18.0","v0.17.1","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.2","0.13.1","0.1.0-alpha.12","0.1.0-alpha.11","0.1.0-alpha.10","0.1.0-alpha.9","0.1.0-alpha.8","0.1.0-alpha.7","0.1.0-alpha.6","0.1.0-alpha.5","0.1.0-alpha.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39958.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}