Arbitrary Command Execution Vulnerability in Melange by Chainguard

CVE-2026-24844

What is CVE-2026-24844?

The Melange tool, a framework enabling users to build APK packages with declarative pipelines, has a security vulnerability. Specifically, in versions 0.3.0 to just before 0.40.3, the software fails to properly sanitize inputs in shell commands. An attacker capable of supplying build input values could execute arbitrary shell commands if the pipeline utilizes ${{vars.}} or ${{inputs.}} substitutions in the working-directory field. This oversight arises due to improper quote escaping within embedded shell scripts, potentially compromising the system's integrity. Users are strongly recommended to update to version 0.40.3 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References