What is the CVSS score of CVE-2026-25143?

CVE-2026-25143 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Melange are affected by CVE-2026-25143?

CVE-2026-25143 affects melange, a build tool used to create APK packages, allowing attackers to execute arbitrary commands on build infrastructure through malicious patch inputs.. A patch is available.

How to fix or mitigate CVE-2026-25143?

Within 24 hours: Inventory all systems running melange versions 0.10.0 to 0.40.2 and isolate affected build pipelines from production environments. Within 7 days: Apply vendor patch to upgrade melange to version 0.40.3 or later across all identified systems; validate patch deployment through test builds. Within 30 days: Conduct code review of recent package builds from vulnerable versions; audit build logs for suspicious patch inputs or unauthorized command execution; implement input validation and least-privilege controls for build pipeline access.

Melange CVE-2026-25143

HIGH

OS Command Injection (CWE-78)

2026-02-04 security-advisories@github.com

GHSA-rf4g-89h5-crcr

Command Injection RCE Melange Suse

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 18, 2026 - 15:55 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

HIGH 7.8

DescriptionGitHub Advisory

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. This issue has been patched in version 0.40.3.

AnalysisAI

Melange versions 0.10.0 through 0.40.2 allow unauthenticated command injection through the patch pipeline, enabling attackers to execute arbitrary shell commands on build hosts by injecting shell metacharacters into patch-related inputs such as series paths and filenames. This vulnerability affects users who build APK packages using melange build or melange license-check operations, particularly in CI/CD environments where build inputs may be controlled by untrusted sources. A patch is available in version 0.40.3 and later.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Melange. melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulne