CVE-2026-29050: Chainguard.dev/melange Path Traversal Vulnerability
MODERATECVE-2026-29050 is a MODERATE (CVSS 6.1) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Chainguard.dev/melange libraries in the Go ecosystem. The issue involves melange has path traversal when resolving external pipelines via unvalidated pipeline[].uses. Remediation is available by upgrading affected packages to version 0.43.4.
CVE-2026-29050 at a Glance
Security Impact
CVSS: 6.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
How to Fix CVE-2026-29050
To remediate this vulnerability, upgrade all affected Chainguard.dev/melange dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade chainguard.dev/melange to 0.43.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for chainguard.dev/melangeHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-29050, inspect your project dependencies for Chainguard.dev/melange:
inspect dependencies for chainguard.dev/melangeAnalyze the terminal output to locate any version of Chainguard.dev/melange in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.43.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Chainguard.dev/melange, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-29050 Affected Chainguard.dev/melange Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
chainguard.dev/melange
|
Go |
≥ 0.32.0
< 0.43.4
|
0.43.4
|
References
Frequently Asked Questions
What is CVE-2026-29050?
Which Chainguard.dev/melange versions are affected?
What version fixes CVE-2026-29050?
Is chainguard.dev/melange affected?
What is the CVSS score of CVE-2026-29050?
What CWE is associated with CVE-2026-29050?
How can I check Go dependencies for CVE-2026-29050?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-98f2-w9h9-7fp9",
"modified" : "2026-04-27T16:34:36Z",
"published" : "2026-04-23T21:53:33Z",
"aliases" : [ "CVE-2026-29050" ],
"summary" : "melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses",
"details" : "### Impact\n\nAn attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set `pipeline[].uses` to a value containing `../` sequences or an absolute path. The `(*Compiled).compilePipeline` function in `pkg/build/compile.go` passed `uses` directly to `filepath.Join(pipelineDir, uses + \".yaml\")` without validating the value, so the resolved path could escape each `--pipeline-dir` and read an arbitrary YAML-parseable file visible to the melange process. Because the loaded file is subsequently interpreted as a melange pipeline and its `runs:` block is executed via `/bin/sh -c` in the build sandbox, this additionally allowed shell commands sourced from an out-of-tree file to run during the build, bypassing the review boundary that normally covers the in-tree pipeline definition.\n\n### Patches\n\nFixed in melange **v0.43.4** via commit [5829ca4](https://github.com/chainguard-dev/melange/commit/5829ca45cfe14dfeb73ffb716992db3b1b7892ac). The fix rejects `uses` values that are absolute paths or contain `..`, and verifies (via `filepath.Rel` after `filepath.Clean`) that the resolved target remains within the pipeline directory.\n\n### Workarounds\n\nOnly run `melange build` against configuration files from trusted sources. In CI systems that build user-supplied melange configs, gate builds behind manual review of `pipeline[].uses` values and reject any containing `..` or leading `/`.\n\n### Credits\n\nmelange thanks Oleh Konko ([@1seal](https://github.com/1seal) from [1seal.org](https://1seal.org/)) for discovering and reporting this issue.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "chainguard.dev/melange"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.32.0"
}, {
"fixed" : "0.43.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/chainguard-dev/melange/security/advisories/GHSA-98f2-w9h9-7fp9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-29050"
}, {
"type" : "WEB",
"url" : "https://github.com/chainguard-dev/melange/commit/5829ca45cfe14dfeb73ffb716992db3b1b7892ac"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/chainguard-dev/melange"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-23T21:53:33Z",
"nvd_published_at" : "2026-04-24T00:16:27Z"
}
}