MEDIUM5.5Go
GHSA-2w4f-9fgg-q2v9· CVE-2026-25145, GO-2026-4409melange has a path traversal in license-path which allows reading files outside workspace
Modified: 9/10/2026
package
Go/chainguard.dev/melange
pkg:go/chainguard.dev/melange
MEDIUM4.4Go
GHSA-5662-cv6m-63wh· CVE-2025-54059, GO-2025-3815melange's world-writable permissions expose SBOM files to potential image tampering
Modified: 9/10/2026
MEDIUM4.3Go
GHSA-7rp8-r62p-q6wc· CVE-2026-29049, GO-2026-4588`melange update-cache` has unbounded HTTP download that can exhaust disk in CI
Modified: 9/10/2026
MEDIUM6.1Go
GHSA-98f2-w9h9-7fp9· CVE-2026-29050, GO-2026-5279melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
Modified: 6/25/2026
HIGH8.3Go
GHSA-fpg8-7664-jc5q· CVE-2026-54174, GO-2026-5968melange: Incomplete package integrity verification allows data section substitution
Modified: 9/10/2026
LOW3.3Go
GHSA-q2pw-xx38-p64j· CVE-2026-29051, GO-2026-5562melange has Path Traversal via .PKGINFO in --persist-lint-results
Modified: 6/25/2026
HIGH8.2Go
GHSA-qxx2-7h4c-83f4· CVE-2026-24843, GO-2026-4407melange QEMU runner could write files outside workspace directory
Modified: 9/10/2026
HIGH7.8Go
GHSA-rf4g-89h5-crcr· CVE-2026-25143, GO-2026-4412melange affected by potential host command execution via license-check YAML mode patch pipeline
Modified: 9/10/2026
HIGH7.9Go
GHSA-vqqr-rmpc-hhg2· CVE-2026-24844, GO-2026-4408melange pipeline working-directory could allow command injection
Modified: 9/10/2026
—Go
GO-2025-3815· CVE-2025-54059, GHSA-5662-cv6m-63whmelange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
Modified: 2/4/2026
—Go
GO-2026-4407· CVE-2026-24843, GHSA-qxx2-7h4c-83f4melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
Modified: 2/5/2026
—Go
GO-2026-4408· CVE-2026-24844, GHSA-vqqr-rmpc-hhg2melange pipeline working-directory could allow command injection in chainguard.dev/melange
Modified: 2/5/2026
—Go
GO-2026-4409· CVE-2026-25145, GHSA-2w4f-9fgg-q2v9melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
Modified: 2/5/2026
—Go
GO-2026-4412· CVE-2026-25143, GHSA-rf4g-89h5-crcrmelange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
Modified: 2/5/2026
—Go
GO-2026-4588· CVE-2026-29049, GHSA-7rp8-r62p-q6wc`melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Modified: 6/26/2026
—Go
GO-2026-5279· CVE-2026-29050, GHSA-98f2-w9h9-7fp9melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
Modified: 6/25/2026
—Go
GO-2026-5562· CVE-2026-29051, GHSA-q2pw-xx38-p64jmelange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
Modified: 6/25/2026
—Go
GO-2026-5968· CVE-2026-54174, GHSA-fpg8-7664-jc5qmelange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Modified: 7/22/2026