Skip to main content
cve.nowby Sazabi
← Go
GoPackage

chainguard.dev/melange

9 known vulnerabilities (4 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 4 high, 5 medium
Registry
pkg.go.dev

Advisories 9

  • melange: Incomplete package integrity verification allows data section substitution

    Affected: fixed in 0.50.4.

  • CVE-2026-29051Medium 4.4

    melange has Path Traversal via .PKGINFO in --persist-lint-results

    Affected: from 0.32.0, fixed in 0.43.4.

  • CVE-2026-29050Medium 6.1

    melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

    Affected: from 0.32.0, fixed in 0.43.4.

  • CVE-2026-29049Medium 4.3

    melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

    Affected: fixed in 0.43.4; all versions.

  • CVE-2026-25145Medium 5.5

    melange has a path traversal in license-path which allows reading files outside workspace

    Affected: from 0.14.0, fixed in 0.40.3.

  • melange affected by potential host command execution via license-check YAML mode patch pipeline

    Affected: from 0.10.0, fixed in 0.40.3.

  • melange pipeline working-directory could allow command injection

    Affected: from 0.3.0, fixed in 0.40.3.

  • melange QEMU runner could write files outside workspace directory

    Affected: from 0.11.3, fixed in 0.40.3.

  • CVE-2025-54059Medium 4.4

    melange creates SBOM files in APKs with world-writable permissions

    Affected: from 0.23.0, fixed in 0.29.5.