Executive brief
melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
Affected products
- Go chainguard.dev/melange
Junglewise Threat Intelligence
CVE-2025-54059: GO-2025-3815 - melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
CVE-2025-54059 · Severity: low · CVSS 3.1 · Published 2025-07-29
Technologies: chainguard.dev/melange (Go). Vendors: Go.
Related threats
- melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to versi
- GO-2026-5562 - melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
- GO-2026-5279 - melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
- Chainguard melange resource exhaustion in update-cache
- GO-2026-4412 - melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange