EUVD-2026-15987

melange pipeline working-directory could allow command injection...

GO-2026-4408 melange pipeline working-directory could allow command injection in chainguard.dev/melange

melange pipeline working-directory could allow command injection in chainguard.dev/melange...

CVE-2026-24844

CVE-2026-24844 affects melange. Affected: melange pipeline building in versions 0.3.0–0.40.2 (before 0.40.3). Vulnerability: in pipelines that use ${{vars.}} or ${{inputs. }} substitutions in working-directory, an attacker who can provide build input values (but cannot modify pipeline definitions...

GHSA-VQQR-RMPC-HHG2 melange pipeline working-directory could allow command injection

An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses $vars. or $inputs. substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. Fix: Fixed with e51ca30c,...