Go to main page
Versions in this module
v0
Oct 11, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Oct 7, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Oct 6, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Oct 3, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 30, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 20, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 17, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 11, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 3, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Sep 3, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 24, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 18, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 14, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 13, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 4, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Aug 4, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 28, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 24, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 17, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 10, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 4, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jul 2, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 23, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 17, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 15, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 13, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 11, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 10, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 5, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Jun 1, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
May 29, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
May 22, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
May 13, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
May 7, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
May 3, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Apr 28, 2026 GO-2026-4588
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Apr 23, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 23, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 17, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 15, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 11, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 2, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Apr 2, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 31, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 26, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 26, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 20, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 13, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 10, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 10, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 9, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 9, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 9, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 8, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 4, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Mar 3, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 27, 2026 GO-2026-4588 +1 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 24, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 20, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 19, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 18, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 10, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 6, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 6, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Feb 4, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 30, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 30, 2026 GO-2026-4588 +3 more
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 28, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 28, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 23, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 20, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 18, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 15, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 13, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 6, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jan 1, 2026 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 22, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 18, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 11, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 9, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 5, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 4, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 3, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Dec 3, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Nov 28, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Nov 20, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Nov 16, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Nov 12, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Nov 7, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Oct 30, 2025 GO-2026-4407 +7 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Oct 24, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Oct 15, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Oct 9, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Oct 4, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Sep 25, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Sep 12, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Sep 8, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Sep 4, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Aug 28, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Aug 21, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Aug 8, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Aug 7, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Aug 1, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 31, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 30, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 26, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 25, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 17, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 17, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 16, 2025 GO-2026-4407 +5 more
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 16, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 16, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 10, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 8, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jul 3, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 27, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 27, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 20, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 13, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 13, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 12, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Jun 11, 2025 GO-2025-3815 +6 more
GO-2025-3815: melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange
GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange
GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange
GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko