Chainguard Melange any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

7CVEs

melange pipeline working-directory could allow command injection

Published 2026-02-04 · Analyzed

8.8EPSS 0.002

melange QEMU runner could write files outside workspace directory

Published 2026-02-04 · Analyzed

8.4EPSS 0.002

melange affected by potential host command execution via license-check YAML mode patch pipeline

Published 2026-02-04 · Analyzed

7.8EPSS 0.002

melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

Published 2026-04-23 · Analyzed

6.1EPSS 0.002

melange has a path traversal in license-path which allows reading files outside workspace

Published 2026-02-04 · Analyzed

5.5EPSS 0.002

melange has Path Traversal via .PKGINFO in --persist-lint-results

Published 2026-04-24 · Analyzed

4.4EPSS 0.002

melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

Published 2026-03-06 · Modified

4.3EPSS 0.004