What’s Vulnerable › Vulnerabilities

CVE-2026-24843: melange QEMU runner could write files outside workspace directory

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-04 · updated 2026-06-17
• Weakness: CWE-22

Description

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.

Affected products

• chainguard-dev melange: from 0.11.3 before 0.40.5 — fixed in 0.40.5

How to fix

Upgrade to a fixed version: chainguard-dev melange 0.40.5. Check the vendor advisory for mitigations.

References

• https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4

Get alerted when CVE-2026-24843 or the next vulnerability affects your stack