chainguard-dev melange vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20268

Newest CVEs

• CVE-2026-54174

  melange: Incomplete package integrity verification allows data section substitution

  chainguard-dev · melange

  High8.3
• CVE-2026-29051

  melange has Path Traversal via .PKGINFO in --persist-lint-results

  chainguard-dev · melange

  Medium4.4
• CVE-2026-29050

  melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

  chainguard-dev · melange

  Medium6.1
• CVE-2026-29049

  melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

  chainguard-dev · melange

  Medium4.3
• CVE-2026-25145

  melange has a path traversal in license-path which allows reading files outside workspace

  chainguard-dev · melange

  Medium5.5
• CVE-2026-25143

  melange affected by potential host command execution via license-check YAML mode patch pipeline

  chainguard-dev · melange

  High7.8
• CVE-2026-24844

  melange pipeline working-directory could allow command injection

  chainguard-dev · melange

  High7.8
• CVE-2026-24843

  melange QEMU runner could write files outside workspace directory

  chainguard-dev · melange

  High8.2
• CVE-2025-54059

  melange creates SBOM files in APKs with world-writable permissions

  chainguard-dev · melange

  Medium4.4