GHSA-vqqr-rmpc-hhg2HighCVSS 7.9

melange pipeline working-directory could allow command injection

Published
February 3, 2026
Last Modified
February 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-24844 →

📋 Description

An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping.

Fix: Fixed with e51ca30c, Released.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

🎯 Affected products1

  • go/chainguard.dev/melange:>= 0.3.0, < 0.40.3

🔗 References (4)