What is GHSA-qxx2-7h4c-83f4?

GHSA-qxx2-7h4c-83f4 is a security advisory published by GitHub Security Advisories with High severity. melange QEMU runner could write files outside workspace directory

Which CVE IDs does GHSA-qxx2-7h4c-83f4 cover?

GHSA-qxx2-7h4c-83f4 covers the following CVE IDs: CVE-2026-24843. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qxx2-7h4c-83f4?

GHSA-qxx2-7h4c-83f4 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-qxx2-7h4c-83f4?

GHSA-qxx2-7h4c-83f4 affects 1 product, including: go/chainguard.dev/melange:\u003e= 0.11.3, \u003c 0.40.3.

GHSA-qxx2-7h4c-83f4HighCVSS 8.2

melange QEMU runner could write files outside workspace directory

Vendor

GitHub Security Advisories

Published

February 3, 2026

Last Modified

February 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-24843 →

📋 Description

An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via ../ sequences.

Fix: Fixed in 6e243d0d. Merged in release.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

🎯 Affected products1

go/chainguard.dev/melange:>= 0.11.3, < 0.40.3

🔗 References (4)

https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b
https://nvd.nist.gov/vuln/detail/CVE-2026-24843
https://github.com/advisories/GHSA-qxx2-7h4c-83f4