7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25143

CVE-2026-25143: melange affected by potential host command execution via license-check YAML mode patch pipeline

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. This issue has been patched in version 0.40.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25143

CVE-2026-25143:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/melange	go	>= 0.10.0, < 0.40.3	0.40.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection within the patch pipeline of the melange build tool. The root cause was the lack of input sanitization for parameters passed to this pipeline, which are used to construct a shell script. The fixing commit, bd132535cd9f57d4bd39d9ead0633598941af030, addresses this by adding validation and quoting directly into the pipeline's shell script located in pkg/build/pipelines/patch.yaml.

The commit also introduces a new test file, pkg/build/patch_pipeline_test.go, which was crucial for identifying the vulnerable function. This test file includes a function, compilePatchPipeline, that simulates the pipeline compilation process. Within this test function, a call is made to c.compilePipeline(...), where c is an object of type *Compiled. This explicitly identifies chainguard.dev/melange/pkg/build.(*Compiled).compilePipeline as the Go function responsible for processing the pipeline and its inputs. This function takes user-controlled data and substitutes it into the script template. Because it originally did so without sanitization, it is the function responsible for creating the injectable command string, making it the primary vulnerable function that would be observed in a runtime profile during exploitation.

Vulnerable functions

chainguard.dev/melange/pkg/build.(*Compiled).compilePipeline

pkg/build/build.go

This function compiles a pipeline by substituting user-controlled inputs into a shell script template. Prior to the fix, it did not sanitize the inputs for shell metacharacters. An attacker could provide a malicious value for inputs such as `series`, `patches`, `strip-components`, or `fuzz`, which would be embedded directly into the shell script by this function. When the resulting script was executed, it would lead to arbitrary command execution on the build host.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.