HIGH🇬🇧 English

CVE-2026-24844

CVSS 7.9v3.1pub. 2026-02-04upd. 2026-02-18

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. This issue has been patched in version 0.40.3.

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

  • Chainguard Melange

    APP
    Chainguard
    0.3.0 – 0.40.5
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Command Injection
CWE
Referencje

Powiązane podatności

CVE-2026-24843HIGH8.2ten sam produkt

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an...

CVE-2026-25143HIGH7.8ten sam produkt

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, ...

CVE-2026-29050MEDIUM6.1ten sam produkt

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior t...

CVE-2026-29051MEDIUM4.4ten sam produkt

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior t...

CVE-2026-29049MEDIUM4.3ten sam produkt

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange u...