Chainguard.Dev Melange vulnerabilities

CVE-2026-24844 [HIGH] CWE-78 melange pipeline working-directory could allow command injection melange pipeline working-directory could allow command injection An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses `${{vars.*}}` or `${{inputs.*}}` substitutions in `working-directory`. The field is embedded into shell scripts without proper quote escaping. **Fix:** Fixed with [e51ca30c](https://github.com/c

CVE-2026-25143 [HIGH] CWE-78 melange affected by potential host command execution via license-check YAML mode patch pipeline melange affected by potential host command execution via license-check YAML mode patch pipeline An attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts witho

CVE-2026-24843 [HIGH] CWE-22 melange QEMU runner could write files outside workspace directory melange QEMU runner could write files outside workspace directory An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The `retrieveWorkspace` function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via `../` sequences. **Fix:** Fixed in [6e243d0d](https://github

CVE-2026-25145 [MEDIUM] CWE-22 melange has a path traversal in license-path which allows reading files outside workspace melange has a path traversal in license-path which allows reading files outside workspace An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license

CVE-2026-29050 [MEDIUM] CWE-22 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses ### Impact An attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set `pipeline[].uses` to a value containing `../` sequences or an absolute path. The `(*Compiled).compilePipeline` function in

CVE-2026-29049 [MEDIUM] CWE-400 `melange update-cache` has unbounded HTTP download that can exhaust disk in CI `melange update-cache` has unbounded HTTP download that can exhaust disk in CI `melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5. **Fix:** Mer

CVE-2025-54059 [MEDIUM] CWE-276 melange's world-writable permissions expose SBOM files to potential image tampering melange's world-writable permissions expose SBOM files to potential image tampering It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666: ``` $ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2>/dev/null var/lib/db/sbom drwxr-xr-x root/root 0 2025-06-23

CVE-2026-29051 [MEDIUM] CWE-22 melange has Path Traversal via .PKGINFO in --persist-lint-results melange has Path Traversal via .PKGINFO in --persist-lint-results ### Impact `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path se

CVE-2026-54174 [HIGH] CWE-345 melange: Incomplete package integrity verification allows data section substitution melange: Incomplete package integrity verification allows data section substitution Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary fil