GO-2026-4409 melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange...

GO-2026-4407 melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

melange QEMU runner could write files outside workspace directory in chainguard.dev/melange...

GO-2026-4408 melange pipeline working-directory could allow command injection in chainguard.dev/melange

melange pipeline working-directory could allow command injection in chainguard.dev/melange...