Arbitrary Command Execution Vulnerability in Melange by Chainguard
CVE-2026-24844

7.8HIGH

Key Information:

Vendor

Chainguard-dev

Status
Melange
Vendor
CVE Published:
4 February 2026

What is CVE-2026-24844?

The Melange tool, a framework enabling users to build APK packages with declarative pipelines, has a security vulnerability. Specifically, in versions 0.3.0 to just before 0.40.3, the software fails to properly sanitize inputs in shell commands. An attacker capable of supplying build input values could execute arbitrary shell commands if the pipeline utilizes ${{vars.}} or ${{inputs.}} substitutions in the working-directory field. This oversight arises due to improper quote escaping within embedded shell scripts, potentially compromising the system's integrity. Users are strongly recommended to update to version 0.40.3 or later to mitigate this risk.

Affected Version(s)

melange >= 0.3.0, < 0.40.3

References

https://github.com/chainguard-dev/melange/security/adviso...
x_refsource_CONFIRM
https://github.com/chainguard-dev/melange/commit/e51ca30c...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.