CVE-2026-25143 is an OS command injection vulnerability classified under CWE-78 affecting the melange tool developed by chainguard-dev. Melange is used to build APK packages via declarative pipelines. Specifically, from versions 0.10.0 up to but not including 0.40.3, the patch pipeline (defined in pkg/build/pipelines/patch.yaml) improperly embeds user-influenced inputs such as series paths, patch filenames, and numeric parameters directly into shell scripts without adequate quoting or validation. This flaw allows shell metacharacters like backticks, command substitutions $(…), semicolons, pipes, or redirections to break out of their intended context and execute arbitrary commands on the build host. The vulnerability can be triggered through melange build and license-check operations when an attacker can control patch-related inputs, for example via pull request-driven CI systems, build-as-a-service platforms, or by manipulating melange configurations. The attacker gains the ability to execute commands with the privileges of the melange build process, which may be significant depending on the environment. The vulnerability requires user interaction (e.g., triggering a build) but no prior authentication or elevated privileges. The issue was publicly disclosed on February 4, 2026, and patched in version 0.40.3. The CVSS v3.1 base score is 7.8, reflecting high severity due to the potential for full confidentiality, integrity, and availability compromise of the build environment. No known exploits in the wild have been reported to date.

For European organizations, this vulnerability poses a significant risk to software supply chain security, particularly for those using melange in automated build pipelines for APK packages. Successful exploitation could lead to arbitrary code execution on build hosts, enabling attackers to inject malicious code into software artifacts, manipulate licensing checks, or disrupt build processes. This undermines the integrity and trustworthiness of software releases, potentially leading to widespread downstream compromise. Organizations relying on CI/CD systems that integrate melange, especially in sectors with stringent software compliance requirements such as automotive, telecommunications, and finance, face elevated risks. The attack vector through pull request-driven CI or build-as-a-service platforms is particularly concerning given the prevalence of collaborative development workflows in Europe. Additionally, the compromise of build infrastructure could facilitate lateral movement within corporate networks, exposing sensitive intellectual property and customer data.

The primary mitigation is to upgrade all instances of melange to version 0.40.3 or later, where the vulnerability has been patched. Organizations should audit their build environments to identify any use of affected melange versions and enforce upgrade policies. Additionally, restrict the sources of patch-related inputs to trusted and authenticated users only, minimizing the risk of malicious input injection. Implement strict input validation and sanitization in any custom pipelines or scripts that interact with melange. Employ least privilege principles for build processes, ensuring melange runs with minimal necessary permissions to limit the impact of potential exploitation. Monitor CI/CD logs and build outputs for anomalous command execution or unexpected behavior. Consider isolating build environments using containerization or sandboxing to contain potential compromises. Finally, educate development and DevOps teams about secure pipeline practices and the risks of command injection vulnerabilities.