CVE-2026-25143

Name of the Vulnerable Software and Affected Versions melange versions 0.10.0 through 0.40.2

Description melange enables users to construct APK packages utilizing declarative pipelines. A flaw exists in versions 0.10.0 up to, but not including, 0.40.3 where an attacker capable of manipulating inputs to the patch pipeline can execute arbitrary shell commands on the build host. This occurs because the patch pipeline, located in pkg/build/pipelines/patch.yaml, incorporates values derived from input—specifically series paths, patch filenames, and numeric parameters—into shell scripts without adequate quoting or validation. This lack of sanitization allows shell metacharacters to escape their intended context. The built-in patch pipeline, accessible through melange build and melange license-check operations, is affected. An attacker controlling patch-related inputs, such as through pull request-driven CI, build-as-a-service, or by altering melange configurations, can inject shell metacharacters like backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process.

Recommendations Upgrade to melange version 0.40.3 or later.