CVE-2026-29051
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
melange versions 0.32.0 through before 0.43.4 construct output file paths in --persist-lint-results by joining --out-dir with arch and pkgname from the APK's .PKGINFO without validating path separators or '..' sequences. An attacker supplying an APK to a melange lint/build pipeline could cause a JSON lint report to be written to an arbitrary reachable path. There is no direct code execution, but other JSON artifacts can be clobbered. The issue is fixed in 0.43.4.
Risk Assessment
JSON files on the system may be overwritten by the melange process, potentially corrupting artifacts or affecting later CI stages. Only deployments explicitly using --persist-lint-results are affected.
Recommendation
Upgrade melange to version 0.43.4 or later. As a workaround, do not pass --persist-lint-results when linting untrusted APKs and run melange as a low-privileged user in an isolated directory.
Other vulnerabilities in melange
See all- CVE-2026-29050Medium
melange (a tool for building apk packages using declarative pipelines) from version 0.32.0 to before 0.43.4 allows an attacker who can influence a melange configuration file to set pipeline[].uses to a value containing ../ sequences or an absolute path. The (*Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validation, so the resolved path could escape --pipeline-dir and read any YAML-parseable file visible to the melange process. Because the loaded file is interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this allowed shell commands from an out-of-tree file to run during the build, bypassing review. Fixed in melange v0.43.4 (commit 5829ca4).
- CVE-2026-29049Medium
Melange version 0.40.5 and earlier downloads URIs from build configs using io.Copy without any size limit or HTTP client timeout. An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk space on the build runner.
Original NVD description (English source)
melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS