chainguard-dev/melange Security Advisories | GitStock

high2026-07-10

melange: Incomplete package integrity verification allows data section substitution

GHSA-fpg8-7664-jc5q · CVE-2026-54174

low2026-04-23

melange has Path Traversal via .PKGINFO in --persist-lint-results

GHSA-q2pw-xx38-p64j · CVE-2026-29051

medium2026-04-23

melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

GHSA-98f2-w9h9-7fp9 · CVE-2026-29050

medium2026-03-02

`melange update-cache` has unbounded HTTP download that can exhaust disk in CI

GHSA-7rp8-r62p-q6wc · CVE-2026-29049

medium2026-02-04

melange has a path traversal in license-path which allows reading files outside workspace

GHSA-2w4f-9fgg-q2v9 · CVE-2026-25145

high2026-02-04

melange affected by potential host command execution via license-check YAML mode patch pipeline

GHSA-rf4g-89h5-crcr · CVE-2026-25143

high2026-02-03

melange pipeline working-directory could allow command injection

GHSA-vqqr-rmpc-hhg2 · CVE-2026-24844

high2026-02-03

melange QEMU runner could write files outside workspace directory

GHSA-qxx2-7h4c-83f4 · CVE-2026-24843

medium2025-07-18

melange's world-writable permissions expose SBOM files to potential image tampering

GHSA-5662-cv6m-63wh · CVE-2025-54059