29 matches found
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the working-directory field when user-supplied input is embedded into shell scripts without proper quote escaping. An attacker can execute arbitrary shell commands by providing crafted build input values that are...
GO-2026-4391 malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction in github.com/chainguard-dev/malcontent
malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction in github.com/chainguard-dev/malcontent...
Malcontent security vulnerabilities
Malcontent is a supply chain attack detection tool developed by Chainguard. Versions of Malcontent prior to 1.20.3 contained a security vulnerability. This vulnerability stemmed from the possibility of creating symbolic links outside of the expected extraction directories when scanning specially...
Improper File Permissions
chainguard.dev/melange is vulnerable to improper file permissions. The vulnerability is due to SBOM files in APKs being generated with file system permissions mode 666, which allows an attacker to tamper with the SBOMs...
Incorrect Default Permissions
Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the updateCache function in the buildimplementation.go file. An attacker can gain unauthorized access to modify critical system files by exploiting overly permissive file permissions. Remediation Upgrad...
melange 安全漏洞
melange is a Chainguard open source for building APKs from source code. A security vulnerability exists in melange versions prior to 0.23.0 through 0.29.5, which stems from improperly set permissions on the SBOM file, which could lead to a tampering attack...
CVE-2024-36127
creationtimestamp| type| source ---|---|--- 2024-06-03 13:18:53+00:00| published-proof-of-concept| https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-qmqp...
