{"cve":"CVE-2026-29051","nvd":{"published":"2026-04-24T00:16:27.477","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":3.3},"cwes":["CWE-22"],"references":["https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac","https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j"],"products":["chainguard:melange"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-29051","score":0.00172,"percentile":0.06571,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-q2pw-xx38-p64j","url":"https://osv.dev/vulnerability/GHSA-q2pw-xx38-p64j","summary":"melange has Path Traversal via .PKGINFO in --persist-lint-results","modified":"2026-06-25T23:11:46.710610858Z","packages":[{"ecosystem":"Go","name":"chainguard.dev/melange","purl":"pkg:golang/chainguard.dev/melange","ranges":[">=0.32.0 <0.43.4"],"fixed":["0.43.4"]}]},{"id":"GO-2026-5562","url":"https://osv.dev/vulnerability/GO-2026-5562","summary":"melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange","modified":"2026-06-25T23:01:23.197871920Z","packages":[{"ecosystem":"Go","name":"chainguard.dev/melange","purl":"pkg:golang/chainguard.dev/melange","ranges":[">=0.32.0 <0.43.4"],"fixed":["0.43.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}