Executive brief
melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
Affected products
- Go chainguard.dev/melange
Junglewise Threat Intelligence
CVE-2026-25143: GO-2026-4412 - melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
CVE-2026-25143 · Severity: low · CVSS 3.1 · Published 2026-02-05
Technologies: chainguard.dev/melange (Go). Vendors: Go.
Related threats
- melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to versi
- GO-2026-5562 - melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
- GO-2026-5279 - melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
- Chainguard melange resource exhaustion in update-cache
- GO-2026-4409 - melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange