Chainguard-dev vulnerabilities
We track 10 vulnerabilities in Chainguard-dev products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest Chainguard-dev vulnerabilities
- 8.3 High severity
melange: Insufficient Verification of Data Authenticity
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the dat
- 7.5 High severity
apko: Insufficient Verification of Data Authenticity
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed ind
- 7.5 High severity
apko: Improper Limitation of a Pathname to a Restricted Directory
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creat
- 7.8 High severity
melange: Improper Neutralization of Special Elements used in an OS Command
melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/p
- 8.8 High severity
melange: Improper Neutralization of Special Elements used in an OS Command
melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{var
- 8.4 High severity
melange: Improper Limitation of a Pathname to a Restricted Directory
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWo
- 7.5 High severity
apko: Allocation of Resources Without Limits or Throttling
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk fu
- 7.5 High severity
apko: Improper Limitation of a Pathname to a Restricted Directory
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (
- 7.0 High severity
apko: Incorrect Default Permissions
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contain
- 7.5 High severity
apko: Insufficiently Protected Credentials
apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.