7.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24844

CVE-2026-24844: melange pipeline working-directory could allow command injection

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.}} or ${{inputs.}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. This issue has been patched in version 0.40.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24844

CVE-2026-24844:

7.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/melange	go	>= 0.3.0, < 0.40.3	0.40.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of user-controllable input within the working-directory field of a Melange pipeline. This input is used to construct shell commands without proper escaping, leading to OS command injection. The analysis of the patch e51ca30cfb63178f5a86997d23d3fff0359fa6c8 reveals several functions where this pattern occurs.

The primary vulnerable function is build.buildEvalRunCommand in pkg/build/pipeline.go. It takes a workdir string and directly concatenates it into a shell script. An attacker could provide a workdir like x'; malicious_command; echo 'x to break out of the intended cd command and execute arbitrary code.

Similarly, the build.(*pipelineRunner).maybeDebug method in the same file uses the workdir to create a debug shell, presenting another injection vector.

Finally, the build.(*Build).BuildPackage method in pkg/build/build.go was also patched to prevent a similar injection vector where a file path (fullPath) was used to construct a setfattr command. While not directly tied to the working-directory field mentioned in the advisory, it represents the same class of vulnerability and was fixed in the same commit.

The fix involves introducing a new function, quoteShellArg, which uses the go-shellquote library to safely escape any special shell characters in the input before it is embedded in a command string, thus neutralizing the injection vector.

Vulnerable functions

build.buildEvalRunCommand

pkg/build/pipeline.go

The 'workdir' parameter, which can be controlled by a user via pipeline configuration, is directly embedded into a shell script using `fmt.Sprintf`. This allows an attacker to inject arbitrary shell commands by crafting a malicious 'workdir' value, as there is no prior sanitization or escaping of shell metacharacters.

build.(*pipelineRunner).maybeDebug

pkg/build/pipeline.go

The 'workdir' variable is used to construct a shell command for a debugging session. The variable is not escaped before being passed to `fmt.Sprintf`, allowing an attacker who can control the 'workdir' value to inject commands that will be executed when the debug mode is triggered.

build.(*Build).BuildPackage

pkg/build/build.go

The 'fullPath' variable is used unsanitized in a `fmt.Sprintf` call to construct a 'setfattr' shell command. If an attacker can influence the 'fullPath' value, they could inject arbitrary shell commands, leading to command execution within the build environment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.