What is the CVSS score of CVE-2026-25143?

CVE-2026-25143 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25143?

Within 24 hours: Inventory all systems running melange versions 0.10.0 to 0.40.2 and isolate affected build pipelines from production environments. Within 7 days: Apply vendor patch to upgrade melange to version 0.40.3 or later across all identified systems; validate patch deployment through test builds. Within 30 days: Conduct code review of recent package builds from vulnerable versions; audit build logs for suspicious patch inputs or unauthorized command execution; implement input validation and least-privilege controls for build pipeline access.

Melange CVE-2026-25143

HIGH

OS Command Injection (CWE-78)

2026-02-04 security-advisories@github.com

GHSA-rf4g-89h5-crcr

RCE Command Injection Melange Suse Chainguard

7.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious patch input with shell metacharacters
Exploit

Supply to melange build command
Execution

Unquoted values embedded in patch.yaml shell script
Impact

Execute arbitrary commands on build host

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	User must invoke melange build with attacker-controlled patch inputs (series paths, patch filenames, or numeric parameters). Requires local access and user interaction to execute the build command. Affects melange versions 0.10.0 to before 0.40.3.
Impact	CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to build apk packages using declarative pipelines.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Melange versions 0.10.0 through 0.40.2 allow unauthenticated command injection through the patch pipeline, enabling attackers to execute arbitrary shell commands on build hosts by injecting shell metacharacters into patch-related inputs such as series paths and filenames. This vulnerability affects users who build APK packages using melange build or melange license-check operations, particularly in CI/CD environments where build inputs may be controlled by untrusted sources. A patch is available in version 0.40.3 and later.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 7.8

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 0.40.3..

Affected Packages

go chainguard.dev/melange fix: 0.40.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-78 (OS Command Injection). Affects Melange. melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulne

Know when Melange gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Feb 18, 2026 - 15:55 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

HIGH 7.8

DescriptionGitHub Advisory

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. This issue has been patched in version 0.40.3.

Executive ViewAI

Why It Matters

CVE-2026-25143 affects melange, a build tool used to create APK packages, allowing attackers to execute arbitrary commands on build infrastructure through malicious patch inputs. Organizations using melange versions 0.10.0 to 0.40.2 face risk of supply chain compromise, where attackers could inject malicious code into packages or exfiltrate sensitive build credentials. This vulnerability directly threatens the integrity of software artifacts and build pipelines.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Restrict melange patch pipeline access to trusted, pre-validated inputs only; (2) Implement strict network segmentation isolating build hosts with egress filtering; (3) Run melange in containerized/sandboxed environments with resource and capability restrictions; (4) Enable comprehensive audit logging of all patch pipeline executions; (5) Require code review for all patch definitions before execution.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.