CVE-2026-24843: 
NixOS vulnerability analysis and mitigation

CVE-2026-24843 is a path traversal vulnerability in Chainguard's melange, a tool for building APK packages using declarative pipelines. The flaw exists in the retrieveWorkspace function of the QEMU runner, which extracts tar entries from a QEMU guest VM without validating that paths remain within the intended workspace directory on the host. It affects melange versions 0.11.3 through 0.40.4 and was disclosed on February 3, 2026, by security researcher Oleh Konko from 1seal. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, Melange Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The retrieveWorkspace function in pkg/build/build.go processes tar entries received from a QEMU guest VM and writes them to the host filesystem without sanitizing entry names for ../ sequences, absolute paths, null bytes, or malicious symlink/hardlink targets. An attacker who can influence the tar stream — for example, by compromising the QEMU guest VM or injecting into the build pipeline — can craft tar entries with traversal sequences (e.g., ../../etc/passwd) to write arbitrary files anywhere on the host. The fix (commit 6e243d0d) introduced an isValidPath() function that validates all tar entry names and link targets before extraction, rejecting absolute paths, ../ traversal, and null bytes (Melange Advisory, Fix Commit).

A successful exploit allows an attacker to write, modify, or delete arbitrary files on the host system outside the designated workspace directory. Specific targets noted in the fix commit include system binaries (e.g., /usr/bin/curl), configuration files (e.g., /etc files), and other host-level resources. When melange is run in privileged container contexts — common in CI/CD build environments — this vulnerability can escalate to a full node escape, enabling lateral movement across the build infrastructure. Confidentiality impact is rated None (the vulnerability enables writes, not reads), while integrity and availability impacts are both rated High (Github Advisory, Fix Commit).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.008% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have influence over the tar stream produced by a QEMU guest VM, which limits the attack surface to scenarios where the guest VM or the build pipeline has been compromised (Github Advisory).

1. Gain influence over the QEMU guest VM: Compromise the QEMU guest VM used during a melange build, or inject into the build pipeline that supplies the tar stream to the host's retrieveWorkspace function.
2. Craft a malicious tar archive: Create a tar archive containing entries with path traversal sequences in their names, such as ../../etc/cron.d/backdoor, ../../usr/bin/curl, or absolute paths like /etc/passwd. Also craft malicious symlink or hardlink entries pointing outside the workspace.
3. Inject the malicious tar stream: Ensure the crafted tar archive is returned as the workspace tar stream from the QEMU guest to the melange host process during the workspace retrieval phase.
4. Trigger workspace extraction: Allow the melange build process to call retrieveWorkspace, which will extract the tar entries without path validation (in vulnerable versions), writing attacker-controlled files to arbitrary host locations.
5. Achieve host compromise: Overwrite critical system files, inject malicious binaries, or modify configuration files to establish persistence or escalate privileges — particularly impactful in privileged container environments where this can result in a full node escape (Melange Advisory, Fix Commit).

• File System: Unexpected files created outside the melange workspace directory (e.g., in /etc/, /usr/bin/, /usr/local/bin/, or other system directories) with timestamps matching build job execution times; modified system binaries or configuration files with unexpected checksums.
• Logs: Melange build logs showing errors related to tar extraction (in patched versions: messages like invalid tar entry path or path traversal detected); absence of such errors in vulnerable versions despite anomalous file writes.
• Process: Unexpected child processes or cron jobs spawned after a melange build completes; new or modified files in /etc/cron.d/ or /etc/cron.daily/ coinciding with build activity.
• Network: Outbound connections from the build host to unknown external IPs shortly after a melange QEMU build job, potentially indicating a backdoor or reverse shell planted via file overwrite (Fix Commit).

Upgrade Chainguard melange to version 0.40.5 or later, which includes the fix introduced in commit 6e243d0d. The GitHub Advisory Database initially listed 0.40.3 as the first patched version, but the Feedly data confirms 0.40.5 as the definitive patched release for affected versions 0.11.3 through 0.40.4. As a workaround where immediate upgrade is not possible, ensure that QEMU guest VMs used in melange builds are fully isolated and sourced only from trusted, verified images to reduce the risk of tar stream manipulation (Github Advisory, Melange Advisory).

The vulnerability was reported by Oleh Konko from security firm 1seal and acknowledged by the Chainguard melange team. Brief mentions appeared on Mastodon and Bluesky via The Hacker Wire shortly after disclosure. Coverage was also noted in German Linux security news (pro-linux.de) and Linux compatibility news aggregators in the days following the advisory publication (Github Advisory).