Go/chainguard.dev/melange CVE-2026-29050: medium 6.1, EPSS 0.18%
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
Action: Upgrade chainguard.dev/melange to 0.43.4 or later.
go get chainguard.dev/melange@v0.43.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.32.0 | 0.43.4 | - |
Fixed versions
| 0.43.4 |
Sources
- osv: GHSA-98f2-w9h9-7fp9
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-98f2-w9h9-7fp9
- https://nvd.nist.gov/vuln/detail/CVE-2026-29050
- https://github.com/chainguard-dev/melange/commit/5829ca45cfe14dfeb73ffb716992db3b1b7892ac
- https://github.com/chainguard-dev/melange
CVE-2026-29050 · published · modified · JSON