CVE-2026-39958

The oma package manager for AOSC OS is vulnerable to a CRLF injection flaw in versions prior to 1.25.2 . The issue exists in oma-topics , which fetches metadata for testing repositories from remote servers but fails to check the name field for transliteration. A malicious party can provide a malf...