CVE-2026-29051

{
  "id": "CVE-2026-29051",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-24T00:16:27.477",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact."
    },
    {
      "lang": "es",
      "value": "melange permite a los usuarios construir paquetes apk usando pipelines declarativos. A partir de la versión 0.32.0 y antes de la versión 0.43.4, ’melange lint --persist-lint-results’ (bandera de activación opcional, también utilizable a través de ’melange build --persist-lint-results’) construye rutas de archivos de salida uniendo “--out-dir” con los valores “arch” y “pkgname” leídos del archivo de control “.PKGINFO” del APK que se está analizando. En las versiones afectadas, estos valores no se validaron para separadores de ruta o secuencias ’..’, por lo que un atacante que pueda suministrar un APK a un pipeline de lint/build basado en melange (por ejemplo, CI que analiza APKs de terceros, o build-as-a-service) podría hacer que melange escriba ’lint-[pkgname]-[pkgver]-r[epoch].json’ en una ruta ’.json’ arbitraria accesible por el proceso de melange. El archivo escrito es un informe de lint JSON cuyo contenido está parcialmente influenciado por el atacante. No hay una ruta directa de ejecución de código, pero la escritura puede sobrescribir otros artefactos JSON en el sistema de archivos. El problema solo afecta a las implementaciones que pasan explícitamente “--persist-lint-results”; la bandera está desactivada por defecto. El problema se corrige en melange v0.43.4 validando ’arch’ y ’pkgname’ para ’..’, ’/’, y ’filepath.Separator’ antes de la construcción de la ruta en ’pkg/linter/results.go’ (commit 84f3b45). Como solución alternativa, no pase “--persist-lint-results” al analizar o construir APKs cuyos contenidos de “.PKGINFO” no sean completamente confiables. Ejecutar melange como un usuario con pocos privilegios y confinar las escrituras a un directorio aislado también limita el impacto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "chainguard-dev",
          "product": "melange",
          "versions": [
            {
              "version": ">= 0.32.0, < 0.43.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-24T13:10:02.108926Z",
          "id": "CVE-2026-29051",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*",
              "versionStartIncluding": "0.32.0",
              "versionEndExcluding": "0.43.4",
              "matchCriteriaId": "3E8363CF-5AF6-4FD7-A491-5D3E8E1F3576"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}