CVE-2026-24844
📋 TL;DR
This vulnerability allows attackers to execute arbitrary shell commands in melange pipelines when they can provide build input values. The issue occurs when ${{vars.*}} or ${{inputs.*}} substitutions are used in working-directory fields without proper quote escaping. Users of melange versions 0.3.0 through 0.40.2 are affected.
💻 Affected Systems
- melange
📦 What is this software?
Melange by Chainguard
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Unauthorized command execution within the build environment, potentially leading to supply chain attacks or credential theft.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only affecting isolated build environments.
🎯 Exploit Status
Exploitation requires ability to provide build input values but not modify pipeline definitions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.40.3
Vendor Advisory: https://github.com/chainguard-dev/melange/security/advisories/GHSA-vqqr-rmpc-hhg2
Restart Required: No
Instructions:
1. Update melange to version 0.40.3 or later using your package manager. 2. For containerized deployments, rebuild images with the patched version. 3. Verify the update was successful.
🔧 Temporary Workarounds
Avoid vulnerable substitutions
allDo not use ${{vars.*}} or ${{inputs.*}} substitutions in working-directory fields in pipeline definitions.
Input validation
allImplement strict input validation for all build input values to prevent command injection.
🧯 If You Can't Patch
- Restrict build input sources to trusted entities only.
- Run melange in isolated containers or sandboxes with minimal privileges.
🔍 How to Verify
Check if Vulnerable:
Check melange version with 'melange version' command and verify if it's between 0.3.0 and 0.40.2.Check Version:
melange versionVerify Fix Applied:
Verify melange version is 0.40.3 or higher using 'melange version' command.📡 Detection & Monitoring
Log Indicators:
- Unexpected shell commands in build logs
- Unusual process execution during builds
- Failed build attempts with suspicious input
Network Indicators:
- Unexpected outbound connections from build systems
- Data exfiltration patterns
SIEM Query:
process.name: "sh" OR process.name: "bash" AND parent_process.name: "melange" AND command_line: "*${{*"