A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9274.json"