Log in Start free

Vulnerability · Published Jul 18, 2025 · Assigned by GitHub_M

CVE-2025-54059melange creates SBOM files in APKs with world-writable permissions

Medium 4.4

In plain English

A medium-severity incorrect default permissions in melange from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 95.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gochainguard.dev/melange0.29.5GHSA-5662-cv6m-63wh
Gochainguard.dev/melange0.29.5GO-2025-3815

Affected products (as reported)

VendorProductVersions
chainguard-dev melange >= 0.23.0, < 0.29.5

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References