VDB
GO-2026-4407
GO-2026-4407
PUBLISHED
melange QEMU runner could write files outside workspace directory in chainguard.dev/melange
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | cg | 0, 0, 0 |
| chainguard.dev | melange | 0.11.3, 0.11.3 |
| wolfi | wolfictl | 0, 0, 0 |
| chainguard | wolfictl | 0, 0, 0 |
Timeline
- Feb 5, 2026 CVE Published
- Feb 5, 2026 CVE Updated
- May 18, 2026 Security Advisory