apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.
CVE-2026-105767 is an OS command injection vulnerability in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu). It arises from improper neutralization of special elements in the project_id or storage_bucket inputs, which are directly interpolated into Bash gcloud storage cp commands. Although the vulnerability allows arbitrary shell command execution on the GitHub Actions runner if an attacker controls these inputs, the only known caller uses repository secrets and runs on trusted triggers, so untrusted input was not known to reach the vulnerable code. The CVSS 4.0 score is low (2.1).
CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu) caused by the use of the backend-facing $scheme variable in nginx.conf for trailing-slash directory redirects. This results in a 301 redirect from HTTPS to HTTP, exposing documentation content to on-path attackers who can read or modify it. The issue arises because TLS terminates at the load balancer, and the redirect sends clients to an unencrypted HTTP URL. Clients enforcing HSTS, such as browsers with the .dev domain preloaded, are not affected. However, clients that do not enforce HSTS, including some command-line HTTP clients and scripts, remain vulnerable.
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.
CVE-2026-29051 is a path traversal vulnerability in chainguard-dev's melange versions from 0.32.0 up to but not including 0.43.4. When the --persist-lint-results flag is used, melange constructs output file paths from unvalidated values in the APK's . PKGINFO file, allowing an attacker supplying a malicious APK to cause melange to write JSON lint reports to arbitrary filesystem locations. This can overwrite existing JSON files but does not allow direct code execution. The vulnerability only affects deployments explicitly using the --persist-lint-results option, which is off by default. The issue is fixed in version 0.
melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set `pipeline[].uses` to a value containing `../` sequences or an absolute path. The `(*Compiled).compilePipeline` function in `pkg/build/compile.go` passed `uses` directly to `filepath.Join(pipelineDir, uses + ".yaml")` without validating the value, so the resolved path could escape each `--pipeline-dir` and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its `runs:` block is executed via `/bin/sh -c` in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition. The issue is fixed in melange v0.43.4 via commit 5829ca4. The fix rejects `uses` values that are absolute paths or contain `..`, and verifies (via `filepath.Rel` after `filepath.Clean`) that the resolved target remains within the pipeline directory. As a workaround, only run `melange build` against configuration files from trusted sources. In CI systems that build user-supplied melange configs, gate builds behind manual review of `pipeline[].uses` values and reject any containing `..` or leading `/`.
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../outside.txt` escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction.
CVE-2026-25145 is a medium severity path traversal vulnerability in chainguard-dev's melange tool versions 0.14.0 up to before 0.40.3. It allows an attacker who can influence melange configuration files—such as via pull request-driven CI or build-as-a-service environments—to read arbitrary files on the host system. The vulnerability arises from insufficient validation of license file paths in the LicensingInfos function, enabling traversal outside the intended workspace directory. The contents of these files can then be embedded into the generated SBOM, facilitating exfiltration of sensitive data through build artifacts. This issue does not require privileges but does require user interaction to trigger a build with a malicious configuration. The flaw has been patched in version 0.
CVE-2026-25143 is a high-severity OS command injection vulnerability in chainguard-dev's melange tool versions 0.10.0 to before 0.40.3. It arises from improper neutralization of special shell characters in the patch pipeline, allowing attackers who can influence patch-related inputs to execute arbitrary shell commands on the build host. Exploitation requires user interaction but no privileges and can lead to full compromise of the build environment. The issue is fixed in version 0.40.3.
CVE-2026-24844 is a high-severity OS command injection vulnerability in chainguard-dev's melange tool versions 0.3.0 up to but not including 0.40.3. The flaw arises when user-controlled input values are substituted into the working-directory field of declarative build pipelines without proper shell escaping, allowing attackers with limited privileges to execute arbitrary shell commands. Exploitation requires the attacker to provide build input values and involves user interaction, but does not require modification of pipeline definitions. The vulnerability impacts confidentiality and integrity but not availability. It has been patched in version 0.40.
CVE-2026-24843 is a high-severity path traversal vulnerability in chainguard-dev's melange tool versions 0.11.3 up to before 0.40.3. It allows an attacker who can influence the tar stream from a QEMU guest VM to write files outside the intended workspace on the host system. This occurs because the retrieveWorkspace function does not properly validate tar entry paths, enabling directory traversal via '.. /' sequences. Exploitation requires local access to influence the tar stream and some user interaction, but no privileges are needed. The vulnerability can lead to integrity and availability impacts by overwriting or creating arbitrary files on the host.
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.
malcontent discovers supply-chain compromises through.context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to create symlinks outside the intended extraction directory when scanning a specially crafted tar or deb archive. The `handleSymlink` function received arguments in the wrong order, causing the symlink target to be used as the symlink location. Additionally, symlink targets were not validated to ensure they resolved within the extraction directory. Version 1.20.3 introduces fixes that swap handleSymlink arguments, validate symlink location, and validate symlink targets that resolve within an extraction directory.