chainguard.dev/melange vulnerabilities (Go)
9 vulnerabilities.
-
chainguard.dev/melangeGo melange: Incomplete package integrity verification allows data section substitution 8.3 High -
chainguard.dev/melangeGo melange has Path Traversal via .PKGINFO in --persist-lint-results 4.4 Medium -
chainguard.dev/melangeGo melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses 6.1 Medium -
chainguard.dev/melangeGo melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI 4.3 Medium -
chainguard.dev/melangeGo melange has a path traversal in license-path which allows reading files outside workspace 5.5 Medium -
chainguard.dev/melangeGo melange affected by potential host command execution via license-check YAML mode patch pipeline 7.8 High -
chainguard.dev/melangeGo melange pipeline working-directory could allow command injection 7.8 High -
chainguard.dev/melangeGo melange QEMU runner could write files outside workspace directory 8.2 High -
chainguard.dev/melangeGo melange creates SBOM files in APKs with world-writable permissions 4.4 Medium