What’s Vulnerable › Products

chainguard-dev melange vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your chainguard-dev melange version is affected

Latest chainguard-dev melange vulnerabilities

• CVE-2026-54174 — melange: Incomplete package integrity verification allows data section substitution (CVSS 8.3)
• CVE-2026-29051 — melange has Path Traversal via .PKGINFO in --persist-lint-results (CVSS 3.3)
• CVE-2026-29050 — melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses (CVSS 6.1)
• CVE-2026-29049 — melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI (CVSS 4.3)
• CVE-2026-25145 — melange has a path traversal in license-path which allows reading files outside workspace (CVSS 5.5)
• CVE-2026-25143 — melange affected by potential host command execution via license-check YAML mode patch pipeline (CVSS 7.8)
• CVE-2026-24844 — melange pipeline working-directory could allow command injection (CVSS 8.8)
• CVE-2026-24843 — melange QEMU runner could write files outside workspace directory (CVSS 8.4)
• CVE-2025-54059 — melange creates SBOM files in APKs with world-writable permissions (CVSS 4.4)