Improper Input Validation in Melange APK Builder by Chainguard

CVE-2026-29051

What is CVE-2026-29051?

The Melange APK Builder allows users to construct APK packages utilizing declarative pipelines. In versions 0.32.0 through 0.43.4, a vulnerability exists where the --persist-lint-results flag may be used to construct output file paths without validating the input from .PKGINFO control files. This oversight enables attackers, capable of submitting a malicious APK to a Melange-based pipeline, to influence the creation of a JSON lint report file at an arbitrary location on the filesystem. Although the attacker cannot execute code directly, this vulnerability can lead to overwriting other JSON artifacts. To mitigate this risk, users should avoid using the --persist-lint-results flag with untrusted APKs and consider running Melange with restricted permissions in isolated environments. The issue has been addressed in version 0.43.4 through enhanced input validation.

References