| Package | Affected versions | Patched versions |
|---|---|---|
| chainguard.dev/melange | ≥ 0.14.0, < 0.40.3 | 0.40.3 |
| melange | ≥ 0.14.0, < 0.40.5 | 0.40.5 |
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.
Fix: Merged in commit 2f95c9f4
Acknowledgements
melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free