GitHub Advisoryadvisory · Go

GHSA-vqqr-rmpc-hhg2 melange pipeline working-directory could allow command injection

HIGH Published 2026-02-03 Modified 2026-02-04 Official page ↗
Aliases
CVE-2026-24844
Ecosystem
Go
Packages
chainguard.dev/melange
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-78
Reviewed
2026-02-03

Affected packages

• Go chainguard.dev/melange: >= 0.3.0, < 0.40.3 → fixed in 0.40.3

Description

An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses `${{vars.*}}` or `${{inputs.*}}` substitutions in `working-directory`. The field is embedded into shell scripts without proper quote escaping. Fix: Fixed with e51ca30c, Released. Acknowledgements melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-24844 melange allows users to build apk packages using declarative pipelines. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References