Chainguard-dev Melange vulnerabilities

• chainguard-dev apko, melange +1 more melange: Incomplete package integrity verification allows data section substitution CVE-2026-54174 Fix available 8.3 HighJuly 10, 2026
• chainguard melange melange has Path Traversal via .PKGINFO in --persist-lint-results CVE-2026-29051 Fix available 4.4 MediumApril 23, 2026
• chainguard melange melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVE-2026-29050 Fix available 6.1 MediumApril 23, 2026
• chainguard melange melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI CVE-2026-29049 Fix available 4.3 MediumMarch 2, 2026
• chainguard melange melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25145 Fix available 5.5 MediumFebruary 4, 2026
• chainguard melange melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143 Fix available 7.8 HighFebruary 4, 2026
• chainguard melange melange pipeline working-directory could allow command injection CVE-2026-24844 Fix available 7.8 HighFebruary 3, 2026
• chainguard melange melange QEMU runner could write files outside workspace directory CVE-2026-24843 Fix available 8.2 HighFebruary 3, 2026
• chainguard-dev melange melange creates SBOM files in APKs with world-writable permissions CVE-2025-54059 Fix available 4.4 MediumJuly 18, 2025