melange QEMU runner could write files outside workspace directory

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-24843 · CVE overview and exploitation status

EUVD-2026-5373

GHSA-qxx2-7h4c-83f4

GO-2026-4407

cve-program · CVE-2026-24843

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b

euvd · EUVD-2026-5373

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b

nvd · CVE-2026-24843

• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4

osv · GHSA-qxx2-7h4c-83f4

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
• https://nvd.nist.gov/vuln/detail/CVE-2026-24843
• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b
• https://github.com/chainguard-dev/melange

osv · GO-2026-4407

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
• https://nvd.nist.gov/vuln/detail/CVE-2026-24843
• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b

No related changes are available here.