container

Oct 11, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Oct 7, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Oct 6, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Oct 3, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 30, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 20, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 17, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 11, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 3, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Sep 3, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 24, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 18, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 14, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 13, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 4, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Aug 4, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 28, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 24, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 17, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 10, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 4, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jul 2, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 23, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 17, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 15, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 13, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 11, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 10, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 5, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Jun 1, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

May 29, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

May 22, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

May 13, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

May 7, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

May 3, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Apr 28, 2026 GO-2026-4588

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

Apr 23, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 23, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 17, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 15, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ ObservabilityHook bool

+ QemuProcess *os.Process

Apr 11, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 2, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 2, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 31, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

+ func LogObservabilityEvents(ctx context.Context, events *ObservabilityEvents)

+ type NetworkConnection struct

+ DstAddr string

+ DstPort uint32

+ Family string

+ Function string

+ Process string

+ Protocol string

+ SrcAddr string

+ SrcPort uint32

+ Timestamp string

+ type ObservabilityEvents struct

+ EventCount int

+ NetworkConnections []NetworkConnection

+ RawData []byte

+ func RetrieveObservabilityEvents(ctx context.Context, cfg *Config) (*ObservabilityEvents, error)

Mar 26, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 26, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 20, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

+ func GenerateBaseInitramfs(ctx context.Context, arch apko_types.Architecture, cfg MicrovmConfig, ...) error

+ type MicrovmConfig struct

+ AdditionalPackages []string

+ ExtraKeys []string

+ Package string

+ Repositories []string

+ func DefaultMicrovmConfig() MicrovmConfig

Mar 13, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 10, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 10, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 9, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 9, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 9, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 8, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 4, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Mar 3, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 27, 2026 GO-2026-4588 +1 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 24, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 20, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 19, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 18, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 10, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 6, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 6, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Feb 4, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 30, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 30, 2026 GO-2026-4588 +3 more

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 28, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 28, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 23, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ VirtiofsEnabled bool

+ VirtiofsdPID int

+ VirtiofsdSocketPath string

Jan 20, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 18, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 15, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 13, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 6, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jan 1, 2026 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 22, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 18, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 11, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 9, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 5, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 4, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 3, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Dec 3, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Nov 28, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Nov 20, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Nov 16, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Nov 12, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Nov 7, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Oct 30, 2025 GO-2026-4407 +7 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ InitramfsPath string

+ VMHostKeyPrivate ed25519.PrivateKey

+ VMHostKeyPrivateKeyBytes []byte

+ VMHostKeyPublic ssh.PublicKey

+ VMHostKeySigner ssh.Signer

Oct 24, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Oct 15, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Oct 9, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Oct 4, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Sep 25, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Sep 12, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Sep 8, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ RunAsGID string

+ SSHBuildClient *ssh.Client

+ SSHControlAddress string

+ SSHControlBuildClient *ssh.Client

+ SSHControlClient *ssh.Client

Sep 4, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Aug 28, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Aug 21, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Aug 8, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Aug 7, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Aug 1, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 31, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 30, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 26, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 25, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 17, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 17, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 16, 2025 GO-2026-4407 +5 more

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 16, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 16, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 10, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 8, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jul 3, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 27, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 27, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ TestRun bool

type Runner

+ GetReleaseData func(ctx context.Context, cfg *Config) (*apko_build.ReleaseData, error)

Jun 20, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 13, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 13, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 12, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 11, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 10, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 6, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 4, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Jun 3, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 30, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ CacheDir string

May 29, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 29, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ QemuPID int

+ SSHClient *ssh.Client

+ WorkspaceClient *ssh.Client

May 22, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 20, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 16, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 16, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 13, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ SSHWorkspaceAddress string

May 12, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ RunAsUID string

May 8, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 6, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

+ const GB

+ const KB

+ const MB

+ const TB

May 5, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 5, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

May 2, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 25, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 24, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Changes in this version

type Config

+ MicroVM bool

Apr 23, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 18, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 15, 2025 GO-2025-3815 +6 more

  GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange

  GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Apr 11, 2025 GO-2025-3815