high7.9
CVE-2026-24844
melange pipeline working-directory could allow command injection
Impact
An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses `${{vars.*}}` or `${{inputs.*}}` substitutions in `working-directory`. The field is embedded into shell scripts without proper quote escaping. **Fix:** Fixed with [e51ca30c](https://github.com/chainguard-dev/melange/commit/e51ca30cfb63178f5a86997d23d3fff0359fa6c8), Released. **Acknowledgements** melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | chainguard.dev/melange | >= 0.3.0, < 0.40.3 | 0.40.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chainguard | Melange | from 0.3.0 through 0.40.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/chainguard-dev/melange/commit/e51ca30cfb63178f5a86997d23d3fff0359fa6c8
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-vqqr-rmpc-hhg2
- https://github.com/advisories/GHSA-vqqr-rmpc-hhg2
- https://nvd.nist.gov/vuln/detail/CVE-2026-24844