CVE-2026-25145
Description
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.
How to fix
- chainguard melange0.40.5 or later
- chainguard.dev/melange0.40.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chainguard melange | 0.14.0 ≤ v < 0.40.5 | 0.40.5 |
| chainguard.dev/melangeGo | 0.14.0 ≤ v < 0.40.3 | 0.40.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.