An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.}} or ${{inputs.}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping.

Fix: Fixed with e51ca30c, Released.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via ../ sequences.

Fix: Fixed in 6e243d0d. Merged in release.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

An attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process.

Fix: Fixed in bd132535 , Released in 0.40.3. Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

Impact

An attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set pipeline[].uses to a value containing ../ sequences or an absolute path. The (Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validating the value, so the resolved path could escape each --pipeline-dir and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition.

Patches

Fixed in melange v0.43.4 via commit 5829ca4. The fix rejects uses values that are absolute paths or contain .., and verifies (via filepath.Rel after filepath.Clean) that the resolved target remains within the pipeline directory.

Workarounds

Only run melange build against configuration files from trusted sources. In CI systems that build user-supplied melange configs, gate builds behind manual review of pipeline[].uses values and reject any containing .. or leading /.

Credits

melange thanks Oleh Konko (@1seal from 1seal.org) for discovering and reporting this issue.

An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. Fix: Merged in commit 2f95c9f4 Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

Impact

melange lint --persist-lint-results (opt-in flag, also usable via melange build --persist-lint-results) constructs output file paths by joining --out-dir with the arch and pkgname values read from the .PKGINFO control file of the APK being linted. In affected versions these values were not validated for path separators or .. sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write lint-<pkgname>-<pkgver>-r<epoch>.json to an arbitrary .json path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass --persist-lint-results; the flag is off by default.

Patches

Fixed in melange v0.43.4 by validating arch and pkgname for .., /, and filepath.Separator before path construction in pkg/linter/results.go (commit 84f3b45).

Workarounds

Do not pass --persist-lint-results when linting or building APKs whose .PKGINFO contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.

Credits

melange thanks Oleh Konko (@1seal from 1seal.org) for discovering and reporting this issue.

melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.

Fix: Merged Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.