Go/chainguard.dev/melange CVE-2025-54059: medium 4.4, EPSS 0.15%

melange's world-writable permissions expose SBOM files to potential image tampering

Action: Upgrade chainguard.dev/melange to 0.29.5 or later.

go get chainguard.dev/melange@v0.29.5

Affected

Fixed versions

Sources

• osv: GHSA-5662-cv6m-63wh
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh
• https://nvd.nist.gov/vuln/detail/CVE-2025-54059
• https://github.com/chainguard-dev/melange/pull/1836
• https://github.com/chainguard-dev/melange/pull/2086
• https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04
• https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1
• https://github.com/chainguard-dev/melange
• https://github.com/chainguard-dev/melange/releases/tag/v0.29.5

CVE-2025-54059 · published 2025-07-18T20:13:21Z · modified 2026-09-10T03:50:25.741848940Z · JSON