CVE-2026-24844: Melange Build System RCE Vulnerability

CVE-2026-24844 Overview

CVE-2026-24844 is a command injection vulnerability affecting Melange, a tool that allows users to build APK packages using declarative pipelines. The vulnerability exists in versions 0.3.0 through 0.40.2, where an attacker who can provide build input values (but cannot modify pipeline definitions) could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in the working-directory field. The field is embedded into shell scripts without proper quote escaping, allowing malicious input to break out of the intended context and execute arbitrary commands.

Critical Impact

Arbitrary shell command execution via unescaped variable substitution in build pipelines, potentially compromising the build environment and supply chain integrity.

Affected Products

• Melange versions 0.3.0 to 0.40.2

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-24844 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-24844

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly referred to as OS Command Injection. The flaw resides in how Melange processes variable substitutions within pipeline definitions.

When a pipeline definition includes ${{vars.*}} or ${{inputs.*}} substitutions in the working-directory field, the values are directly embedded into shell scripts that execute during the build process. Because these values are not properly quoted or escaped before being embedded, an attacker can craft malicious input values that include shell metacharacters to escape the intended context and inject arbitrary commands.

This is particularly dangerous in CI/CD and supply chain contexts where build inputs may come from external sources such as configuration files, environment variables, or user-provided parameters. An attacker who can influence these input values—without having direct access to modify the pipeline YAML definitions—can achieve code execution in the build environment.

Root Cause

The root cause is insufficient input sanitization in the variable substitution mechanism. When the working-directory field is processed, the substituted values from ${{vars.*}} or ${{inputs.*}} are interpolated directly into shell command strings without proper quoting or escaping of shell-special characters. This allows shell metacharacters like semicolons, backticks, $(), and pipes to be interpreted by the shell rather than treated as literal string content.

Attack Vector

The attack vector requires local access with low privileges and some user interaction. An attacker must be able to provide or influence build input values that flow into a pipeline using the vulnerable substitution patterns in working-directory fields. For example, if a build configuration accepts a user-supplied directory name that gets substituted via ${{inputs.directory}}, an attacker could provide a malicious value such as innocent; malicious_command # which would cause the shell to execute malicious_command when the directory value is embedded into the generated script.

The vulnerability allows scope change, meaning that while the attack originates from the attacker's context, the impact can extend to other components or systems that depend on the compromised build output.

Detection Methods for CVE-2026-24844

Indicators of Compromise

• Unexpected shell commands appearing in build logs during Melange pipeline execution
• Build processes spawning unusual child processes or network connections
• Anomalous file system modifications in build environments that don't match expected build outputs
• Suspicious entries in shell history or process audit logs on build systems

Detection Strategies

• Monitor Melange build logs for shell syntax errors or unexpected command output that may indicate injection attempts
• Implement process monitoring on build systems to detect unusual process trees spawned during package builds
• Audit pipeline definitions for use of ${{vars.*}} or ${{inputs.*}} in working-directory fields and validate all input sources
• Deploy SentinelOne agents on build infrastructure to detect and block anomalous command execution patterns

Monitoring Recommendations

• Enable verbose logging for all Melange build operations to capture substitution values and executed commands
• Configure alerting on build systems for process execution patterns that deviate from baseline build behavior
• Implement input validation monitoring to detect attempts to inject shell metacharacters into build configuration parameters

How to Mitigate CVE-2026-24844

Immediate Actions Required

• Upgrade Melange to version 0.40.3 or later immediately
• Audit all existing pipeline definitions to identify uses of ${{vars.*}} or ${{inputs.*}} in working-directory fields
• Review and restrict sources of build input values to trusted origins only
• Consider temporarily disabling pipelines that use the vulnerable substitution pattern until patching is complete

Patch Information

Chainguard has released version 0.40.3 of Melange which addresses this vulnerability by properly escaping variable substitutions before embedding them into shell scripts. The fix is available in the GitHub commit e51ca30cfb63178f5a86997d23d3fff0359fa6c8. Additional details are available in the GitHub Security Advisory GHSA-vqqr-rmpc-hhg2.

Workarounds

• Avoid using ${{vars.*}} or ${{inputs.*}} substitutions in working-directory fields until the patch is applied
• Implement strict input validation on all values that may be substituted into pipeline definitions, rejecting inputs containing shell metacharacters
• Run build processes in isolated environments with minimal privileges to limit the impact of potential exploitation

# Verify Melange version and upgrade if necessary
melange version
# If version is between 0.3.0 and 0.40.2, upgrade immediately:
# Using go install:
go install chainguard.dev/melange@v0.40.3