Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-24843melange QEMU runner could write files outside workspace directory
High 8.2
In plain English
A high-severity path traversal in melange from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | chainguard.dev/melange | 0.40.3 | GHSA-qxx2-7h4c-83f4 |
| Go | chainguard.dev/melange | 0.40.3 | GO-2026-4407 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | melange | >= 0.11.3, < 0.40.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H