Security
فارسی
All products

chainguard.dev/melange

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
melange QEMU runner could write files outside workspace directoryCVE-2026-24843 · GHSA-QXX2-7H4C-83F4Version ranges need review. chainguard.dev/melange Go High Fix reported
melange: Incomplete package integrity verification allows data section substitutionCVE-2026-54174 · GHSA-FPG8-7664-JC5QVersion ranges need review. chainguard.dev/apkochainguard.dev/melange Go High Fix reported
`melange update-cache` has unbounded HTTP download that can exhaust disk in CICVE-2026-29049 · GHSA-7RP8-R62P-Q6WCVersion ranges need review. chainguard.dev/melange Go Medium Fix reported
melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143 · GHSA-RF4G-89H5-CRCRVersion ranges need review. chainguard.dev/melange Go High Fix reported
melange pipeline working-directory could allow command injectionCVE-2026-24844 · GHSA-VQQR-RMPC-HHG2Version ranges need review. chainguard.dev/melange Go High Fix reported
melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25145 · GHSA-2W4F-9FGG-Q2V9Version ranges need review. chainguard.dev/melange Go Medium Fix reported
melange's world-writable permissions expose SBOM files to potential image tamperingCVE-2025-54059 · GHSA-5662-CV6M-63WHVersion ranges need review. chainguard.dev/melange Go Medium Fix reported
melange has Path Traversal via .PKGINFO in --persist-lint-resultsCVE-2026-29051 · GHSA-Q2PW-XX38-P64JVersion ranges need review. chainguard.dev/melange Go Low Fix reported
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].usesCVE-2026-29050 · GHSA-98F2-W9H9-7FP9Version ranges need review. chainguard.dev/melange Go Medium Fix reported