HIGH8.2

GHSA-qxx2-7h4c-83f4

melange QEMU runner could write files outside workspace directory

Quick fix

GHSA-qxx2-7h4c-83f4 — chainguard.dev/melange: upgrade to the fixed version with the command below.

go get chainguard.dev/melange@v0.40.3

Details

An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The `retrieveWorkspace` function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via `../` sequences.

**Fix:** Fixed in [6e243d0d](https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b). Merged in release.

**Acknowledgements**

melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/chainguard.dev/melange

Introduced in: 0.11.3Fixed in: 0.40.3

Fixgo get chainguard.dev/melange@v0.40.3

References

https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-24843[ADVISORY]
https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b[WEB]
https://github.com/chainguard-dev/melange[PACKAGE]