chainguard.dev/melange vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-29051Lowchainguard.dev/melange: melange has Path Traversal via .PKGINFO in --persist-lint-results CVE-2026-29050Mediumchainguard.dev/melange: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVE-2026-29049Mediumchainguard.dev/melange: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI CVE-2026-25145Mediumchainguard.dev/melange: melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25143Highchainguard.dev/melange: melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-24844Highchainguard.dev/melange: melange pipeline working-directory could allow command injection CVE-2026-24843Highchainguard.dev/melange: melange QEMU runner could write files outside workspace directory CVE-2025-54059Mediumchainguard.dev/melange: melange's world-writable permissions expose SBOM files to potential image tampering

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo