chainguard.dev/melange vulnerabilities

Latest chainguard.dev/melange CVEs

Newest publication first

1. CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

   Published 2026-09-11

   High·CVSS 8.3 EPSS 0.16%

   melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actu...

2. CVE-2026-29051 melange has Path Traversal via .PKGINFO in --persist-lint-results

   Published 2026-04-24

   Low·CVSS 3.3 EPSS 0.17%

   melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, melange lint --persist-lint-results (opt-in flag, also usable via melange build --persist-lint-results) constructs output file paths by joining --out-di...

3. CVE-2026-29050 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

   Published 2026-04-23

   Medium·CVSS 6.1 EPSS 0.14%

   melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set pipe...

4. CVE-2026-29049 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

   Published 2026-03-06

   Medium·CVSS 4.3 EPSS 0.26%

   melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a mel...

5. CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace

   Published 2026-02-04

   Medium·CVSS 5.5 EPSS 0.19%

   melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host...

6. CVE-2026-25143 melange affected by potential host command execution via license-check YAML mode patch pipeline

   Published 2026-02-04

   High·CVSS 7.8 EPSS 0.20%

   melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml...

7. CVE-2026-24844 melange pipeline working-directory could allow command injection

   Published 2026-02-04

   High·CVSS 8.8 EPSS 0.20%

   melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.}} or ${{inputs.}}...

8. CVE-2026-24843 melange QEMU runner could write files outside workspace directory

   Published 2026-02-04

   High·CVSS 8.4 EPSS 0.19%

   melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function ext...

9. CVE-2025-54059 melange creates SBOM files in APKs with world-writable permissions

   Published 2025-07-18

   Medium·CVSS 4.4 EPSS 0.15%

   melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.