CVE-2026-25145

In melange, a path traversal vulnerability exists in LicensingInfos (pkg/config/config.go) where license-path is not validated to stay within the workspace. From version 0.14.0 up to before 0.40.3, an attacker who can influence a melange config (e.g., PR-driven CI or build‑as‑a‑service) could rea...

PT-2026-6272

Name of the Vulnerable Software and Affected Versions melange versions 0.14.0 through 0.40.2 Description melange allows users to build apk packages using declarative pipelines. An attacker who can influence a melange configuration file could read arbitrary files from the host system. The...