GitHub Advisoryadvisory · Go

GHSA-qxx2-7h4c-83f4 melange QEMU runner could write files outside workspace directory

HIGH Published 2026-02-03 Modified 2026-02-04 Official page ↗
Aliases
CVE-2026-24843
Ecosystem
Go
Packages
chainguard.dev/melange
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-02-03

Affected packages

• Go chainguard.dev/melange: >= 0.11.3, < 0.40.3 → fixed in 0.40.3

Description

An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The `retrieveWorkspace` function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via `../` sequences. Fix: Fixed in 6e243d0d. Merged in release. Acknowledgements melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-24843 melange allows users to build apk packages using declarative pipelines. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References