Vulnerability Description
melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. This issue has been patched in version 0.40.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Chainguard | Melange | >= 0.3.0, <= 0.40.5 |
Related Weaknesses (CWE)
References
- https://github.com/chainguard-dev/melange/commit/e51ca30cfb63178f5a86997d23d3fffPatch
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-vqqr-rmpc-hhgPatchVendor Advisory
FAQ
What is CVE-2026-24844?
CVE-2026-24844 is a vulnerability with a CVSS score of 7.9 (HIGH). melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could ...
How severe is CVE-2026-24844?
CVE-2026-24844 has been rated HIGH with a CVSS base score of 7.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24844?
Check the references section above for vendor advisories and patch information. Affected products include: Chainguard Melange.