CVE-2026-24843
High
Description
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
SeverityHigh
CVSS8.2
Exploit probability—
ProductChainguard Melange
PublishedFeb 4, 2026
First seenFeb 4, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- chainguard melange0.40.5 or later
- chainguard.dev/melange0.40.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chainguard melange | 0.11.3 ≤ v < 0.40.5 | 0.40.5 |
| chainguard.dev/melangeGo | 0.11.3 ≤ v < 0.40.3 | 0.40.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.