melange CVE-2026-29050
MEDIUM
GHSA-98f2-w9h9-7fp9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
AV:N reflects the primary remote PR-submission attack vector; AC:H for required CI deployment context; I:H upgraded from vendor I:L to reflect arbitrary shell execution capability.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Impact
An attacker who can influence a melange configuration file - for example through pull-request-driven CI or build-as-a-service scenarios - could set pipeline[].uses to a value containing ../ sequences or an absolute path. The (*Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validating the value, so the resolved path could escape each --pipeline-dir and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition.
Patches
Fixed in melange v0.43.4 via commit 5829ca4. The fix rejects uses values that are absolute paths or contain .., and verifies (via filepath.Rel after filepath.Clean) that the resolved target remains within the pipeline directory.
Workarounds
Only run melange build against configuration files from trusted sources. In CI systems that build user-supplied melange configs, gate builds behind manual review of pipeline[].uses values and reject any containing .. or leading /.
Credits
melange thanks Oleh Konko (@1seal from 1seal.org) for discovering and reporting this issue.
AnalysisAI
Path traversal in Chainguard's melange build tool (versions >= 0.32.0, < 0.43.4) allows an attacker who can influence a melange configuration file to escape the designated pipeline directory via ../ sequences or absolute paths in pipeline[].uses, enabling both arbitrary file reads and shell command execution within the build sandbox. This is acutely dangerous in pull-request-driven CI or build-as-a-service scenarios where untrusted contributors can submit melange configs that are automatically built without review. No public exploit has been identified at time of analysis; EPSS of 0.01% and SSVC exploitation status 'none' confirm no observed active exploitation, but the impact of arbitrary shell execution during a trusted build pipeline makes this high-priority for affected CI deployments.
Technical ContextAI
melange is a Chainguard-developed APK package build tool written in Go (pkg:go/chainguard.dev/melange) used to build software packages in a sandboxed environment. Pipeline definitions are YAML files that can reference external pipeline fragments via the pipeline[].uses field. The vulnerable function (*Compiled).compilePipeline in pkg/build/compile.go constructed file paths by passing the user-controlled uses value directly to filepath.Join(pipelineDir, uses + ".yaml") without any sanitization or boundary check. CWE-22 (Path Traversal) manifests when user-controlled input is incorporated into a filesystem path without validation, allowing directory escape via ../ components or absolute paths. Critically, the loaded YAML file's runs: block is subsequently passed to /bin/sh -c within the build sandbox, elevating what begins as an arbitrary file read into arbitrary shell code execution. The fix in v0.43.4 (commit 5829ca4) adds two-layer validation: it first rejects uses values that are absolute paths or contain .., then verifies via filepath.Rel after filepath.Clean that the resolved target remains under the pipeline directory.
RemediationAI
Upgrade melange to v0.43.4 or later, which contains the validated path resolution fix via commit 5829ca4 (https://github.com/chainguard-dev/melange/commit/5829ca45cfe14dfeb73ffb716992db3b1b7892ac); the full advisory is at https://github.com/chainguard-dev/melange/security/advisories/GHSA-98f2-w9h9-7fp9. If immediate upgrade is not possible, the vendor recommends running melange build only against configuration files from fully trusted sources. In CI systems that process user-supplied melange configs, implement a mandatory manual review gate for all pipeline[].uses values before triggering a build, rejecting any value containing .. or a leading /. This gate trades CI throughput for security and must be enforced pre-build, not post-submission, since the vulnerability is triggered at build time.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today