TI-2026-20043 CVE-2026-24844 · GHSA-vqqr-rmpc-hhg2
melange pipeline working-directory could allow command injection
Priority LOW 39
melange allows users to build apk packages using declarative pipelines.
chainguard-dev
Records26All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9
Exploited now
chainguard-dev records in CISA KEVNo chainguard-dev vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Melange · all components
TI-2026-20042 CVE-2026-24843 · GHSA-qxx2-7h4c-83f4
melange QEMU runner could write files outside workspace directory
Priority LOW 36
melange allows users to build apk packages using declarative pipelines.
TI-2026-20305 CVE-2026-25143 · GHSA-rf4g-89h5-crcr
melange affected by potential host command execution via license-check YAML mode patch pipeline
Priority LOW 35
melange allows users to build apk packages using declarative pipelines.
TI-2026-23195 CVE-2026-29050 · GHSA-98f2-w9h9-7fp9
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
Priority LOW 26
melange allows users to build apk packages using declarative pipelines.
TI-2026-20307 CVE-2026-25145 · GHSA-2w4f-9fgg-q2v9
melange has a path traversal in license-path which allows reading files outside workspace
Priority LOW 24
melange allows users to build apk packages using declarative pipelines.
TI-2026-23196 CVE-2026-29051 · GHSA-q2pw-xx38-p64j
melange has Path Traversal via .PKGINFO in --persist-lint-results
Priority LOW 20
melange allows users to build apk packages using declarative pipelines.
TI-2026-23194 CVE-2026-29049 · GHSA-7rp8-r62p-q6wc
melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI
Priority LOW 20
melange allows users to build apk packages using declarative pipelines.