# CVE-2026-29050: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

Source: https://junglewise.ai/threats/cve-2026-29050-melange-has-path-traversal-when-resolving-external-pipelines-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24  
License: CC BY 4.0 with a link back

CVE-2026-29050 · Severity: medium · CVSS 6.1 · Published 2026-04-24

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set `pipeline[].uses` to a value containing `../` sequences or an absolute path. The `(*Compiled).compilePipeline` function in `pkg/build/compile.go` passed `uses` directly to `filepath.Join(pipelineDir, uses + ".yaml")` without validating the value, so the resolved path could escape each `--pipeline-dir` and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its `runs:` block is executed via `/bin/sh -c` in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition. The issue is fixed in melange v0.43.4 via commit 5829ca4. The fix rejects `uses` values that are absolute paths or contain `..`, and verifies (via `filepath.Rel` after `filepath.Clean`) that the resolved target remains within the pipeline directory. As a workaround, only run `melange build` against configuration files from trusted sources. In CI systems that build user-supplied melange configs, gate builds behind manual review of `pipeline[].uses` values and reject any containing `..` or leading `/`.

Technologies: [Chainguard Melange](https://junglewise.ai/threats/technologies/melange), [chainguard.dev/melange (Go)](https://junglewise.ai/threats/technologies/chainguard-dev-melange). Vendors: [Chainguard](https://junglewise.ai/threats/vendors/chainguard), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-29050 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29050 being exploited in the wild.

**How severe is CVE-2026-29050?** Medium severity, with a CVSS score of 6.1, published 24 April 2026.

**Which products and versions are affected?** chainguard.dev/melange (Go) SEMVER:introduced=0.32.0,fixed=0.43.4.

**Is there a fix for CVE-2026-29050?** Yes. chainguard.dev/melange (Go): upgrade to 0.43.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-29050?** Check whether you run Chainguard Melange or chainguard.dev/melange (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- chainguard.dev/melange (Go): upgrade to 0.43.4 or later

  ```sh
  go get chainguard.dev/melange@v0.43.4
  ```


## Affected products

- Chainguard Melange
- chainguard.dev/melange (Go) SEMVER:introduced=0.32.0,fixed=0.43.4

## Identifiers

- CVE-2026-29050
- GHSA-98f2-w9h9-7fp9
- GO-2026-5279

## Related threats

- [Chainguard Melange and Apko incomplete package integrity verification](https://junglewise.ai/threats/cve-2026-54174-chainguard-melange-and-apko-incomplete-package-integrity)
- [GO-2026-5562 - melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange](https://junglewise.ai/threats/cve-2026-29051-melange-has-path-traversal-via-pkginfo-in-persist-lint-results)
- [Chainguard melange resource exhaustion in update-cache](https://junglewise.ai/threats/cve-2026-29049-chainguard-melange-resource-exhaustion-in-update-cache)
- [melange affected by potential host command execution via license-check YAML mode patch pipeline](https://junglewise.ai/threats/cve-2026-25143-melange-affected-by-potential-host-command-execution-via-license)
- [melange has a path traversal in license-path which allows reading files outside workspace](https://junglewise.ai/threats/cve-2026-25145-melange-has-a-path-traversal-in-license-path-which-allows-reading)