CVE-2025-54059

melange creates SBOM files in APKs with world-writable permissions

CVSS 4.4 MEDIUMEPSS 0.1%CWE-276

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.4EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

18 Jul 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products

chainguard-dev · melange

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04 https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1 https://github.com/chainguard-dev/melange/pull/1836 https://github.com/chainguard-dev/melange/pull/2086 https://github.com/chainguard-dev/melange/releases/tag/v0.23.0 https://github.com/chainguard-dev/melange/releases/tag/v0.29.5 https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh