GHSA-q2pw-xx38-p64j

Source

https://github.com/advisories/GHSA-q2pw-xx38-p64j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-q2pw-xx38-p64j/GHSA-q2pw-xx38-p64j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q2pw-xx38-p64j

Aliases

Published

2026-04-23T21:54:10Z

Modified

2026-06-25T23:11:46Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

melange has Path Traversal via .PKGINFO in --persist-lint-results

Details

Impact

melange lint --persist-lint-results (opt-in flag, also usable via melange build --persist-lint-results) constructs output file paths by joining --out-dir with the arch and pkgname values read from the .PKGINFO control file of the APK being linted. In affected versions these values were not validated for path separators or .. sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write lint-<pkgname>-<pkgver>-r<epoch>.json to an arbitrary .json path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass --persist-lint-results; the flag is off by default.

Patches

Fixed in melange v0.43.4 by validating arch and pkgname for .., /, and filepath.Separator before path construction in pkg/linter/results.go (commit 84f3b45).

Workarounds

Do not pass --persist-lint-results when linting or building APKs whose .PKGINFO contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.

Credits

melange thanks Oleh Konko (@1seal from 1seal.org) for discovering and reporting this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-23T21:54:10Z",
    "nvd_published_at":  "2026-04-24T00:16:27Z",
    "severity":  "LOW"
}

References

Affected packages

Go / chainguard.dev/melange

Package

Name: chainguard.dev/melange; View open source insights on deps.dev
Purl: pkg:golang/chainguard.dev/melange

Affected ranges

Type: SEMVER
Events: Introduced

0.32.0

Fixed

0.43.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-q2pw-xx38-p64j/GHSA-q2pw-xx38-p64j.json"