melange QEMU runner could write files outside workspace directory
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed melange (chainguard-dev): 0.40.3chainguard.dev/melange (Go): 0.40.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chainguard-dev | melange | 0.11.3 to before 0.40.3 | 0.40.3 | Patch available | CNA |
| — | chainguard.dev/melange (Go) | 0.11.3 to before 0.40.3 | 0.40.3 | Patch available | GHSA-qxx2-7h4c-83f4 |
- melange Vendorchainguard-dev Affected 0.11.3 to before 0.40.3 Fixed in 0.40.3 Patch available CNA
- chainguard.dev/melange (Go) Vendor— Affected 0.11.3 to before 0.40.3 Fixed in 0.40.3 Patch available GHSA-qxx2-7h4c-83f4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* | 0.11.3 to before 0.40.5 | Vulnerable | chainguard-dev |
- cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* Versions 0.11.3 to before 0.40.5 Vulnerable ·chainguard-dev
Remediation
- Fix · CNA melange (chainguard-dev) Fixed in 0.40.3
- Fix · GHSA-qxx2-7h4c-83f4 chainguard.dev/melange (Go) Fixed in 0.40.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24843
- 2026-10-03 Alias added: GHSA-qxx2-7h4c-83f4
References
More chainguard-dev Melange vulnerabilities
- TI-2026-20043 melange pipeline working-directory could allow command injection CVSS 3.1HIGH 8.8
- TI-2026-20305 melange affected by potential host command execution via license-check YAML mode patch pipeline CVSS 3.1HIGH 7.8
- TI-2026-23195 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVSS 3.1MEDIUM 6.1
- TI-2026-20307 melange has a path traversal in license-path which allows reading files outside workspace CVSS 3.1MEDIUM 5.5
- TI-2026-23196 melange has Path Traversal via .PKGINFO in --persist-lint-results CVSS 3.1MEDIUM 4.4
- TI-2026-23194 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-24843 · CVE Program
- CVE-2026-24843 · NVD
- FIRST EPSS
- GHSA-qxx2-7h4c-83f4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences