CVE-2026-24843
High · 8.2CVSS
8.2
EPSS
0.2%
Published
Feb 4, 2026
CISA due date
—
The record
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | chainguard.dev/melange | 0.11.3 | 0.40.3 |
| Chainguard | cg | 0 | 0.2.201-r0 |
| Chainguard | wolfictl | 0 | 0.39.0-r1 |
| Wolfi | wolfictl | 0 | 0.39.0-r1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- CVE-2026-25145 melange allows users to build apk packages using declarative pipelines. Also affects chainguard.dev/melange
- CVE-2026-25143 melange allows users to build apk packages using declarative pipelines. Also affects chainguard.dev/melange
- CVE-2026-24844 melange allows users to build apk packages using declarative pipelines. Also affects chainguard.dev/melange
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects cg
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects cg
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects cg
- CVE-2026-33481 Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM)… Also affects cg
- CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB… Also affects cg