chainguard-dev/melange · Security
melange pipeline working-directory could allow command injection
- GHSA ID
- GHSA-vqqr-rmpc-hhg2
- CVE ID
- CVE-2026-24844
- Severity
- high
- Published
- Updated
- CVSS
- 7.9 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS v3
- 7.9 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Description
An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping.
Fix: Fixed with e51ca30c, Released.
Acknowledgements
melange thanks Oleh Konko from 1seal for discovering and reporting this issue.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')