Vulnetix
Try Vulnetix Request Demo
CVE-2025-54059 PUBLISHED CVSS 4.400000095367432 MEDIUM

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

EPSS 0.02% · 6.2th percentile

Risk Scores

CVSS v3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score
0.02%
6.2th percentile

Affected Products

VendorProductVersions
chainguard.devmelange0.23.0
chainguard-devmelange*

Timeline

References

Open in Interactive Console →