GHSA-vqqr-rmpc-hhg2

Source

https://github.com/advisories/GHSA-vqqr-rmpc-hhg2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-vqqr-rmpc-hhg2/GHSA-vqqr-rmpc-hhg2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vqqr-rmpc-hhg2

Aliases

Downstream

CGA (4)

Published

2026-02-03T23:48:25Z

Modified

2026-07-17T21:08:27Z

Severity

7.9 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

melange pipeline working-directory could allow command injection

Details

An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping.

Fix: Fixed with e51ca30c, Released.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-03T23:48:25Z",
    "nvd_published_at":  "2026-02-04T20:16:05Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / chainguard.dev/melange

Package

Name: chainguard.dev/melange; View open source insights on deps.dev
Purl: pkg:golang/chainguard.dev/melange

Affected ranges

Type: SEMVER
Events: Introduced

0.3.0

Fixed

0.40.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-vqqr-rmpc-hhg2/GHSA-vqqr-rmpc-hhg2.json"