Vulnerabilities

TI-2026-23196 CVE-2026-29051 · GHSA-q2pw-xx38-p64j

melange has Path Traversal via .PKGINFO in --persist-lint-results

LOW 20

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00172 Published 2026-04-24 Fixed in 0.43.4 CWE-22

TI-2026-23195 CVE-2026-29050 · GHSA-98f2-w9h9-7fp9

LOW 26

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.0014 Published 2026-04-23 Fixed in 0.43.4 CWE-22

TI-2026-23194 CVE-2026-29049 · GHSA-7rp8-r62p-q6wc

LOW 20

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00263 Published 2026-03-06 Fixed in 0.43.4 CWE-400

TI-2026-20307 CVE-2026-25145 · GHSA-2w4f-9fgg-q2v9

LOW 24

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00191 Published 2026-02-04 Fixed in 0.40.3 CWE-22

TI-2026-20305 CVE-2026-25143 · GHSA-rf4g-89h5-crcr

LOW 35

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00199 Published 2026-02-04 Fixed in 0.40.3 CWE-78

TI-2026-20043 CVE-2026-24844 · GHSA-vqqr-rmpc-hhg2

LOW 39

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00198 Published 2026-02-04 Fixed in 0.40.3 CWE-78

TI-2026-20042 CVE-2026-24843 · GHSA-qxx2-7h4c-83f4

LOW 36

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00186 Published 2026-02-04 Fixed in 0.40.3 CWE-22