{"id":"EUVD-2026-25356","enisaUuid":"a91de702-ea27-369a-828f-2d50b7c5f001","description":"melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-\u003cpkgname\u003e-\u003cpkgver\u003e-r\u003cepoch\u003e.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.","datePublished":"Apr 24, 2026, 12:00:36 AM","dateUpdated":"Apr 24, 2026, 1:10:10 PM","baseScore":4.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j\nhttps://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac\n","aliases":"CVE-2026-29051\nGHSA-q2pw-xx38-p64j\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"a292d615-2439-37d0-bbf5-105d7775c04b","product":{"name":"melange","vendor":{"name":"chainguard-dev"}},"product_version":"0.32.0, \u003c 0.43.4"}],"enisaIdVendor":[{"id":"518900b9-d9b1-32fa-adac-1d23239cfc54","vendor":{"name":"chainguard-dev"}}],"enisaIdVulnerability":[{"id":"edf5842a-239c-39fe-bf9c-17843024c6be","vulnerability":{"id":"GHSA-q2pw-xx38-p64j","description":"melange has Path Traversal via .PKGINFO in --persist-lint-results","datePublished":"Apr 23, 2026, 9:54:10 PM","dateUpdated":"Apr 27, 2026, 4:35:07 PM","baseScore":0.0,"references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-29051\nhttps://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac\nhttps://github.com/chainguard-dev/melange\n","enisa_id":"EUVD-2026-25356\n","aliases":"CVE-2026-29051\nGHSA-q2pw-xx38-p64j\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f2e46dc3-d5f2-31ce-99b2-8b4279730e8e","vulnerability":{"id":"CVE-2026-29051","description":"melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-\u003cpkgname\u003e-\u003cpkgver\u003e-r\u003cepoch\u003e.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.","datePublished":"Apr 24, 2026, 12:00:36 AM","dateUpdated":"Apr 24, 2026, 1:10:10 PM","status":"PUBLISHED","baseScore":4.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","references":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j\nhttps://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac\n","enisa_id":"EUVD-2026-25356\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Nov 1, 2026, 4:08:26 AM","vulnerabilityProduct":[{"id":"9861e32f-1b3d-3794-ba10-cc0bb23979b0","product":{"name":"melange","vendor":{"name":"chainguard-dev"}},"product_version":"0.32.0, \u003c 0.43.4"}],"vulnerabilityVendor":[{"id":"dd1ff249-7725-3df4-ada2-0b9f1fc54485","vendor":{"name":"chainguard-dev"}}]}}],"enisaIdAdvisory":[]}