melange affected by potential host command execution via license-check YAML mode patch pipeline
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. This issue has been patched in version 0.40.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chainguard-dev | melange | 0.10.0 to before 0.40.3 | 0.40.3 | Patch available | CNA |
| — | chainguard.dev/melange (Go) | 0.10.0 to before 0.40.3 | 0.40.3 | Patch available | GHSA-rf4g-89h5-crcr |
- melange Vendorchainguard-dev Affected 0.10.0 to before 0.40.3 Fixed in 0.40.3 Patch available CNA
- chainguard.dev/melange (Go) Vendor— Affected 0.10.0 to before 0.40.3 Fixed in 0.40.3 Patch available GHSA-rf4g-89h5-crcr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* | 0.10.0 to before 0.40.5 | Vulnerable | chainguard-dev |
- cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* Versions 0.10.0 to before 0.40.5 Vulnerable ·chainguard-dev
Remediation
- Fix · CNA melange (chainguard-dev) Fixed in 0.40.3
- Fix · GHSA-rf4g-89h5-crcr chainguard.dev/melange (Go) Fixed in 0.40.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25143
- 2026-10-03 Alias added: GHSA-rf4g-89h5-crcr
References
More chainguard-dev Melange vulnerabilities
- TI-2026-20043 melange pipeline working-directory could allow command injection CVSS 3.1HIGH 8.8
- TI-2026-20042 melange QEMU runner could write files outside workspace directory CVSS 3.1HIGH 8.4
- TI-2026-23195 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVSS 3.1MEDIUM 6.1
- TI-2026-20307 melange has a path traversal in license-path which allows reading files outside workspace CVSS 3.1MEDIUM 5.5
- TI-2026-23196 melange has Path Traversal via .PKGINFO in --persist-lint-results CVSS 3.1MEDIUM 4.4
- TI-2026-23194 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-25143 · CVE Program
- CVE-2026-25143 · NVD
- FIRST EPSS
- GHSA-rf4g-89h5-crcr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences