GO-2026-5279 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline.uses in chainguard.dev/melange...

GO-2026-4408 melange pipeline working-directory could allow command injection in chainguard.dev/melange

melange pipeline working-directory could allow command injection in chainguard.dev/melange...

GO-2026-4412 melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the working-directory field when user-supplied input is embedded into shell scripts without proper quote escaping. An attacker can execute arbitrary shell commands by providing crafted build input values that are...