GHSA-vqqr-rmpc-hhg2
melange pipeline working-directory could allow command injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | chainguard.dev/melange | >= 0.3.0, < 0.40.3 | 0.40.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses `${{vars.*}}` or `${{inputs.*}}` substitutions in `working-directory`. The field is embedded into shell scripts without proper quote escaping.
**Fix:** Fixed with [e51ca30c](https://github.com/chainguard-dev/melange/commit/e51ca30cfb63178f5a86997d23d3fff0359fa6c8), Released.
**Acknowledgements**
melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
References
External links from the advisory. They lead to third-party sites.